Loading story…
Attackers gained unauthorized access to Microsoft’s official @Microsoft X account, which has more than 13 million followers, and used it to promote a purported $Clippy cryptocurrency in an apparent pump-and-dump scheme. The account’s profile image was changed to Clippy and it followed and reposted material from @clippymsftcto, an impersonation account that falsely claimed the token’s liquidity pool was tied directly to $MSFT; the impersonator was later suspended.
Microsoft removed the unauthorized content, secured the account, disavowed any cryptocurrency affiliation, and said it is investigating the compromise and will pursue legal action over misuse of its brands and intellectual property. The intrusion method remains unconfirmed; potential avenues cited include phishing, SIM swapping, a compromised recovery email, infostealer-stolen session cookies, or compromised authorized social-media tooling. The incident follows the June 2024 takeover of Microsoft India’s X account, which was used to distribute a cryptocurrency wallet-drainer lure.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
An unauthorized party accessed Microsoft’s @Microsoft X account, which had more than 13 million followers, and changed its profile image to Clippy. The compromised account followed and reposted content from the Clippy-impersonating @clippymsftcto account to amplify a purported $Clippy cryptocurrency token.
Eric Council Jr. pleaded guilty for his role in the conspiracy to compromise the SEC’s X account and manipulate Bitcoin’s value.
Crypto scammers compromised Microsoft India’s @MicrosoftIndia X account, impersonated Keith Gill’s Roaring Kitty persona, and directed users to a purported GameStop crypto-presale site. The site used a wallet drainer to steal assets from users who connected wallets and approved transactions.
Attackers compromised the U.S. Securities and Exchange Commission’s @SECGov account through SIM swapping and posted a false claim that Bitcoin exchange-traded funds had been approved. The post temporarily drove up Bitcoin’s price.
ScamSniffer reported that a Twitter advertising campaign using the MS Drainer wallet drainer stole approximately $59 million in cryptocurrency from 63,000 people between March and November 2023.
Microsoft removed unauthorized posts and secured its official X account after the takeover. It said it has no affiliation with cryptocurrency tokens associated with Clippy, Microsoft, or $MSFT, is investigating the intrusion, and plans legal action over unauthorized use of its brands and intellectual property.
Eric Council Jr. was sentenced to 14 months in prison for his involvement in the conspiracy to compromise the SEC’s X account.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcemkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Aug 11, 2026
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026