Microsoft X Account Hijack Used Clippy for $Clippy Token Promo

Attackers gained posting rights without triggering visible MFA challenges, consistent with infostealer cookie theft or a compromised social management platform rather than credential phishing. The account followed the scammer handle and amplified a liquidity pool post pairing $Clippy with $MSFT before Microsoft regained control roughly 30 minutes later. No CVE or infrastructure IOCs have been published.

Similar takeovers of the SEC and other verified accounts in 2024 relied on SIM swaps or session cookie exfiltration via malware such as RedLine or Lumma. Microsoft has released no timeline or attribution details, leaving open whether the vector was an employee endpoint, a vendor OAuth token, or X-side privilege escalation. The deleted apology post confirmed no corporate endorsement of the token.

The incident reveals persistent gaps in high-value social account hardening despite documented patterns. Third-party marketing tools with persistent write access remain an under-audited attack surface across Fortune 500 X presences.

Microsoft has not committed to publishing a post-incident report. Expect continued silence on root cause unless regulatory pressure or a separate breach forces disclosure within 60 days.