Attackers gained unauthorized access to Microsoft's official X social media account and used it to amplify a cryptocurrency scam involving a Clippy-themed token. They replaced the profile picture and posted messages promoting the token, misleading followers. Microsoft confirmed the breach, removed the posts, secured the account, and is investigating. The attackers' method of access is unknown but may involve credential theft, SIM swapping, session cookie theft, or compromised third-party tools. The fraudulent accounts promoting the token were suspended, and Microsoft clarified it does not endorse any cryptocurrency related to its brand.

The incident allowed attackers to misuse a high-profile corporate social media account to promote a fraudulent cryptocurrency token, potentially misleading millions of followers and damaging Microsoft's brand reputation. There is no indication of direct compromise of Microsoft’s internal systems or data. The attack could facilitate financial fraud against followers who trust the official account's endorsements.

Microsoft has secured the compromised account and removed unauthorized posts. Organizations should monitor for unauthorized social media activity and investigate access controls and third-party integrations. Since the exact compromise vector is unknown, reviewing multi-factor authentication settings, employee security awareness, and third-party tool security is recommended. No specific patch is applicable. Microsoft is continuing its investigation.