A Timeline of Microsoft’s X Account Takeover and What It Teaches Small Businesses
Attackers took over Microsoft’s official X account to push a crypto token. A short timeline of what happened, plus lessons for protecting your own company’s accounts.
When the official Microsoft account on X, followed by more than 13 million people, started acting strangely, it became a lesson in how fragile even the biggest brand accounts can be. Here is how events unfolded, and how this incident compares with earlier ones.
Earlier warnings
- June 2024: Crypto scammers hijacked the Microsoft India account on X, which had more than 211,000 followers. They posed as a well-known meme-stock trader and steered people to a fake “presale” site that stole the crypto of anyone who connected a wallet and approved transactions.
- The SEC account: The U.S. Securities and Exchange Commission’s X account was compromised through a SIM-swapping attack, in which a criminal gets a phone number moved to a device they control. A fake announcement about Bitcoin funds briefly moved the price, and the hacker was later sentenced to 14 months in prison.
The Microsoft incident
- Thursday, October 1: The Microsoft account followed and reposted a post from a lookalike account styled after Clippy, the old Office assistant. The Verge reported it first.
- Meanwhile: An account that reposted Microsoft’s post kept promoting a “$Clippy” token and claimed it had a liquidity pool paired directly with $MSFT. BleepingComputer describes the whole episode as looking like a pump-and-dump scheme.
- Then: Microsoft removed the unauthorized posts and told The Verge it had confirmed unauthorized access, that the account was secured and that the investigation continues.
- A public statement: In a post that has since been deleted, Microsoft apologized, said it has not authorized or endorsed any token tied to Clippy, Microsoft or its stock, and promised to pursue legal action to have the token and related material removed.
- Still unknown: How the attackers got in has not been made public.
Takeaways for your company’s online accounts
You do not need 13 million followers to be a target. A hijacked business page can be used to mislead customers just as easily. A few habits go a long way:
- Secure the phone number, too. The SEC case shows why SIM swapping matters. Ask your mobile carrier about a port-out lock or account PIN, and use an authenticator app or security key instead of text-message codes where possible.
- Keep a list of who has access. Include employees, agencies and freelancers, remove people who have left and avoid shared passwords.
- Decide in advance who responds. Know who can regain control, who speaks to customers and how you will correct the record publicly.
Need help locking down your company’s accounts? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
The timeline above draws on BleepingComputer’s coverage of the Microsoft X account takeover, which in turn cites The Verge.
About The Author
