← Back to Blog

Web3 Security · 7 min read · November 4, 2026

How Hackers Hijack X Accounts to Promote Fake Crypto Tokens in 2026

A hijacked social account is the cheapest distribution network in crypto: no exploit, no audited contract, just a trusted name and a token that did not exist an hour ago. On October 2, 2026, attackers used Microsoft’s X account and its 13 million followers to promote a fake $Clippy token. Here is how these takeovers work and how to tell a real launch from a stolen megaphone.

What a hijacked-account token scam looks like

On October 2, 2026, attackers took over Microsoft’s official X account and used its roughly 13 million followers to promote a fraudulent token called $Clippy. They replaced the profile picture with the company’s old Clippy mascot, followed and reposted impersonation accounts claiming the coin had liquidity paired with Microsoft stock, and then deleted the posts once the account was secured. Microsoft’s India account had been hit earlier in the same pattern.

The targets are chosen for reach and institutional authority, not for crypto knowledge. In January 2024 a hijacked SEC account announced a spot Bitcoin ETF approval that had not happened, and the market moved before the denial. In February 2025 a BBC presenter’s account launched a Solana token called $Today. The Tor Project’s account was breached the same season. In every case the account was real and the token was not.

Why attackers target accounts instead of wallets

Draining a wallet requires a victim to sign something. Hijacking an account requires no victim action beyond reading a post from a name they already trust, which makes it the cheapest attack in crypto.

• Distribution is already built. A hundred thousand followers is an audience that took years to assemble and can be borrowed in an afternoon.
• There is no code to audit. The token is new, thin and often unverified, but nobody checks a contract when a familiar logo is attached to it.
• The lifecycle is hours. A memecoin can be spun up and given a liquidity pool in a couple of hours, which is faster than any takedown process.

The incentive is measurable. Chainalysis estimated crypto scam losses near $17 billion in 2025 and found AI-enabled scams roughly 4.5 times more profitable than traditional ones. A stolen megaphone plus machine-written copy is the whole business model.

How the account actually gets taken

Four paths explain most takeovers, and only one of them involves guessing a password.

1. Policy-notice phishing. The email claims a terms violation or a copyright complaint and links to an “Action Needed” page that asks you to log in. The BBC presenter who lost his account to a $Today post said his main mistake was not checking the sender address.
2. Session-token theft. Infostealer malware copies the session cookie from the browser and the attacker resumes an already-authenticated session. No password, no 2FA prompt, no alert.
3. SIM swap. The attacker ports the phone number, resets the password by SMS and locks the owner out. Cifas recorded a 1,055% rise in unauthorised SIM swaps from 2023 to 2024, and SIM swaps appear in roughly a third of high-value US crypto thefts.
4. Insider and consent abuse. Coinbase’s 2025 breach of 69,000 customers began with bribed support staff, and Crypto.com lost $34 million from 483 accounts in 2022 through a two-factor bypass.

The infrastructure is boring, and that is the point

SentinelLabs tracked one campaign against high-profile X accounts that has run continuously since mid-2024, targeting journalists, politicians, an X employee and large technology brands. It uses two lures, a login notice and a copyright violation, and hides the phishing link behind Google’s AMP cache on the theory that a cdn.ampproject.org address will survive mail filtering. The pages sit on cheap VPS hosting and default site-builder templates. The same kit has been used to harvest Telegram credentials. Nothing about it is sophisticated, which is why it keeps working.

Red flags on the timeline

• A company with no crypto products suddenly announces a token.
• The avatar changes to a mascot and the older posts no longer match the voice.
• The account follows a cluster of brand-new impersonation handles.
• The claim is anchored to something real, a stock, a partnership, a liquidity promise, with no filing and nothing on the company’s own site.
• Replies are restricted, so corrections cannot surface under the post.
• The destination is a domain registered days ago.

How to lock down your own account

1. Move off SMS and app codes to a passkey or hardware security key. Neither stops cookie theft, both stop a phished password.
2. Revoke live sessions after any scare. Check the active-sessions list for devices and locations you do not recognise, then sign everything out.
3. Audit connected apps monthly. Third-party posting tools are a standing grant of write access and are rarely reviewed.
4. Give the account its own email address. Isolation stops a single credential-stuffed inbox from becoming a handle takeover.
5. Treat every policy notice as fake. Navigate to the platform directly and open settings yourself, never through the link.
6. Scan the machine you post from. Session-cookie theft is malware on your device, not a weakness in the platform.

If your account is already taken over

Work from a clean device. Reset the account password and the email password, revoke every session and connected app, then re-check the recovery phone number and backup address the attacker may have changed. Warn your audience from another channel before the hijacker starts direct-messaging your contacts with a support pitch. Report the impersonation handles as well, because a stolen account is often resold or recycled for a second wave a few weeks later.

What to do when an account you follow shills a token

Check the company’s own website and its investor disclosures before touching a contract. If a launch exists only on social media, it does not exist. No legitimate token needs you to connect a wallet and sign an approval to claim it, and an approval is not a purchase: it can hand unlimited spending rights over assets you already hold. Treat a token shilled from a compromised brand account as a drainer link with better branding.