Clippy Token ($CLIPPY) — Microsoft X Account Hijack
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2qbndy…jqmASummary
On October 2, 2026, unknown attackers hijacked Microsoft's official X account — which has over 13 million followers — for approximately 30 minutes and used it to promote an unauthorized Clippy-themed cryptocurrency token ($CLIPPY) on the Solana blockchain. The incident is characterized by multiple reporters as a pump-and-dump scheme. Microsoft has confirmed the account compromise, denied any association with the token, and stated it will pursue legal action. No attacker has been publicly identified, and the compromise method has not been officially disclosed.
Connected Entities
3 entities · 1 linked investigation- GyGYxT…pump→mentioned with→Clippy Token ($CLIPPY) — Microsoft X Account Hijack(50%)
- 7eMJmn…pump→mentioned with→Clippy Token ($CLIPPY) — Microsoft X Account Hijack(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇7eMJmn…pumpwallet
Timeline(7 events)
4 June 2024
Microsoft India's verified X account is compromised in a SIM-swapping attack. Attackers impersonate investor Keith Gill to promote a fraudulent GameStop crypto presale and direct followers to a wallet-draining phishing site.
Winbuzzer / Blockonomi / CryptoTimes29 October 2024
A Solana token named 'Microsoft Mascot' with symbol CLIPPY (contract: GyGYxT6XVwtAuEEVSn2V6YZ7bgkCxkjVzyWt8ogtpump) is created on the Solana blockchain via Pump.fun.
Phantom token page11 August 2025
An older Clippy-themed Solana token (Clippy PFP Cult, contract: 7eMJmn1bYWSQEwxAX7CyngBzGNGu1cT582asKxxRpump) reaches an all-time high market cap of approximately $36.6 million.
LoreScreener / Bitget2 October 2026
Microsoft's official X account (@Microsoft, 13+ million followers) is compromised by unknown actors. The account follows and reposts content from impersonator account @clippymsftcto, changes its profile picture to Clippy, and posts '500,000 likes and we bring Clippy back.' A second account (@ClippyMSFT) simultaneously promotes a $CLIPPY token on Solana, falsely claiming it has liquidity paired with Microsoft's $MSFT stock ticker.
BleepingComputer / SecurityWeek / CryptoTimes2 October 2026
Microsoft regains control of its X account within approximately 30 minutes. All unauthorized posts are removed. Microsoft spokesperson Brent Colburn confirms the breach and states the company is investigating.
SecurityWeek2 October 2026
Microsoft issues a public denial: 'Microsoft has not authorized, sponsored, endorsed, or granted permission for the creation, promotion, or use of any cryptocurrency token associated with Clippy, Microsoft, or $MSFT.' Microsoft announces it will pursue legal action. Microsoft later deletes its own apology/disclaimer post.
CryptoBriefing / BleepingComputer2 October 2026
X suspends the @clippymsftcto impersonator account. The @ClippyMSFT account continues promoting the $CLIPPY token.
CryptoTimes / Windows LatestDecision Log
- hash: 6JnSrFL8FVA6DoxTNuF3iYMoxUTq1GnZfWL4E2mRVhex
This investigation is cryptographically anchored to the Solana blockchain (1 event). 6 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/2/2026, 5:17:59 PM
last updated: 10/2/2026, 6:10:04 PM
avoid.net — verified advice for a post-truth world