When a company as large and security-conscious as Microsoft falls victim to a social media hijacking, the cybersecurity community pays attention. The incident that unfolded on Microsoft’s official Twitter account last Thursday was not just another account takeover—it was a bizarre, almost nostalgic prank with a sinister financial motive. Hackers seized control of the account, which boasts over 13 million followers, replaced the profile picture with Clippy—the notoriously annoying paperclip assistant from 1990s Microsoft Office—and began promoting a cryptocurrency scam. The episode, which ultimately included a fake apology from the attackers themselves, highlights the evolving tactics of cybercriminals who are increasingly targeting high-profile accounts to push crypto fraud and steal from unsuspecting users.<\/p>\n
On the afternoon of October 10, 2024, followers of Microsoft’s Twitter feed noticed something odd. The account’s avatar had changed to Clippy, the goggle-eyed paperclip that once interrupted Word documents to offer unsolicited help. The account also followed a Clippy-themed crypto account and shared one of its posts. The post came from an account called Clippy MSFT<\/strong>, which posed as Clippy acting as Microsoft’s Chief Technology Officer. Meanwhile, a second account aggressively promoted a token called Clippy Coin<\/strong>, claiming its liquidity was paired with Microsoft’s stock price—a claim designed to trick investors into thinking the cryptocurrency had a legitimate corporate backing.<\/p>\n Approximately 30 minutes after the first posts appeared, a polished, corporate-style apology was published on Microsoft’s Twitter feed. It stated that Microsoft was aware of the unauthorized use of the Clippy brand and that the company did not endorse any cryptocurrency. But then, without explanation, the apology vanished. Microsoft later confirmed that the apology was also posted by the hackers, not by the company itself. The attackers had maintained control of the account long enough to issue a seemingly genuine mea culpa, likely to lull followers into a false sense of security before planning further malicious activity—though no second wave of posts materialized before Microsoft regained control.<\/p>\n Security researcher and podcast host Graham Cluley, who covered the incident on the Smashing Security<\/a><\/em> podcast, noted the peculiarity: “These hackers seized control of a Twitter account with 13 million followers. The mischief they could have caused. But what they decided was that they were just going to go with a paperclip. No ransomware, no data theft, no phishing, just a paperclip and an apology.”<\/p>\n Microsoft has not publicly disclosed the root cause of the compromise. However, security experts point to several possible vectors: a successful phishing attack against a social media manager, a SIM-swap attack that intercepted password reset codes, stolen session cookies from info-stealing malware that bypassed multi-factor authentication, or a compromised third-party social media management tool. X itself (formerly Twitter) has also been the source of account takeovers in the past, such as the infamous Bitcoin scam tweet from July 2020 that compromised high-profile accounts including Joe Biden and Elon Musk.<\/p>\n Regardless of the method, the incident serves as a stark reminder that even the most sophisticated organizations can be vulnerable to account hijacking. The attackers’ choice to promote a cryptocurrency scam rather than launch ransomware or data theft is telling: crypto scams offer a quick, relatively low-effort path to monetization, and the Clippy brand provided an instantly recognizable hook that tapped into nostalgia and corporate parody.<\/p>\n The Microsoft hack comes during Cybersecurity Awareness Month, a time when organizations in the UK and elsewhere increase their focus on online safety. According to new figures released by Action Fraud<\/strong>, the national cybercrime reporting service run by the City of London Police, the amount of money stolen through the hacking of email and social media accounts has skyrocketed by 417% over the past year. For the financial year 2025–2026, reported losses reached \u00a36.3 million, up from \u00a31.2 million the previous year.<\/p>\n These figures represent only the tip of the iceberg. Many victims do not report smaller losses—perhaps \u00a3100 here or \u00a3200 there—out of embarrassment or the belief that the sum is too small to warrant police attention. But as the total sum shows, these small losses add up. Criminals are increasingly hijacking accounts and then using them to defraud the victim’s own friends and family, exploiting trust to make the scams far more effective.<\/p>\n One of the most common tactics involves offering fake tickets to sold-out events. The scam works like this: a criminal gains control of a person’s Facebook or Instagram account, then posts a message claiming that the account owner can no longer attend a hot-ticket event and is selling the tickets. Friends who see the post and trust the source transfer money directly to the scammer’s bank account. In one case reported by The Guardian<\/em>, a woman whose Instagram was hacked lost \u00a31,400 after her friends bought fake Oasis reunion tickets advertised through her account.<\/p>\n Another variant uses fraudulent text messages or WhatsApp messages pretending to be a family member in urgent need of money. These “hi mum, I’ve lost my phone” scams have become so common that many recipients now recognise them instantly, but the scammers only need a small success rate to make the operation profitable.<\/p>\n The City of London Police and the UK’s National Cyber Security Centre (NCSC) have issued guidance for individuals to reduce their risk of falling victim to these scams. The advice is straightforward but worth repeating, especially for friends and family who may not follow cybersecurity news closely.<\/p>\n These measures may seem basic, but social engineering remains one of the most effective attack vectors because it preys on human emotions—trust, urgency, and fear. Even cybersecurity professionals have admitted to almost falling for well-crafted scams.<\/p>\n While the Microsoft Clippy hack and the rise in social media hijacking represent the current threat landscape, the security industry is also grappling with a transformative technology: AI agents<\/a>. In a featured interview on the same Smashing Security<\/a><\/em> episode, Christine Bartlett, CMO of Hack The Box, discussed how organisations are now managing two kinds of workers—humans and AI agents—and the new risks this introduces.<\/p>\n Hack The Box helps companies train their human security teams and, more recently, appraise the performance of AI agents. Bartlett explained that many organisations are in a “grey area” between basic ChatGPT usage and fully autonomous AI security operations. Most rate themselves at a 2 or 3 on a scale of 1 to 5, where 5 represents an “AI factory” with autonomous loops.<\/p>\n Bartlett outlined four specific dangers that can lurk beneath the surface of AI-deployment dashboards:<\/p>\nHow Did the Attackers Breach Microsoft’s Account?<\/h2>\n
Cybersecurity Awareness Month: A 417% Surge in Social Media Account Hijacking<\/h2>\n
The Ticket Scam That Cost \u00a31,400<\/h3>\n
Simple Tips to Protect Yourself from Account Hijacking<\/h2>\n
\n
The Rise of AI Agents in Security Teams: Opportunity and Risk<\/h2>\n
Four Hidden Risks of AI in Security<\/h3>\n