Even a blue verification badge does not guarantee that a social‑media account is safe from hijacking. Recent incidents show how attackers can seize high‑profile accounts and use their built‑in credibility to push fraudulent cryptocurrency schemes.
Microsoft’s X account compromised
Microsoft’s official X account, which boasts more than 13 million followers, was briefly taken over by unknown actors. During the breach the account reposted content from a Clippy‑themed profile that promoted a new cryptocurrency called $Clippy. The company later confirmed that the posts were unauthorized, removed them, and secured the account. A Microsoft spokesperson said, “We have confirmed unauthorized access to our account on X, including posts that did not originate from Microsoft. The account has been secured, the unauthorized posts have been removed, and we are continuing to investigate the circumstances.”
Why verified badges can be misleading
The verification badge tells users that an account belongs to the named organization, but it does not indicate who is currently controlling the account. Once attackers gain access—often through phishing, SIM swapping, or other credential‑theft methods—they inherit the trust that followers have already placed in the brand.
Similar tactics were used against HBO Max’s verified Reddit account, where hackers pushed more than 100 malicious ads in a two‑day window. The ads appeared legitimate because they came from a familiar, verified source.
Past examples illustrate the risk
In June 2024, scammers hijacked Microsoft India’s X account and impersonated popular investor Keith Gill (“Roaring Kitty”) to promote a fictitious GameStop cryptocurrency presale. Victims who followed the provided link risked having their crypto wallets drained by malware.
Another high‑profile case involved the U.S. Securities and Exchange Commission’s official X account in January 2024. Attackers posted a false announcement that the SEC had approved spot Bitcoin exchange‑traded funds, causing Bitcoin’s price to jump more than $1,000 before the agency corrected the error and the price fell by over $2,000. The perpetrators gained access through a SIM‑swap attack on the account’s phone number. One of the attackers, Eric Council Jr., pleaded guilty to conspiracy charges in February 2025 and received a 14‑month prison sentence.
Practical steps to protect yourself
When a company announces a cryptocurrency, giveaway, or major investment opportunity, go directly to the organization’s official website or newsroom. If the only source is a single social‑media post, pause before acting.
Watch for sudden shifts in an account’s content. If a tech‑focused profile suddenly starts promoting an obscure crypto token, treat it as a warning sign and verify the claim elsewhere.
Never share recovery phrases, private keys, or passwords in response to a social‑media link. Use a trusted device and navigate directly to the service you intend to use.
Strong antivirus software can flag phishing sites and malicious downloads, but it should complement—not replace—careful scrutiny of links. Look closely at URLs for subtle misspellings or extra characters that could redirect you to a fraudulent site.
Enable two‑factor authentication (2FA) using an authenticator app or passkey rather than relying solely on texted codes. A unique, strong password for each important account, managed with a reputable password manager, further reduces the risk of credential theft.
Stay vigilant
Scammers often create urgency, claiming a token launch is “right now” or that an offer expires in minutes. Give yourself time to verify the information through independent sources before committing any money or personal data.
By treating verification badges as a helpful identifier—not a guarantee of safety—online users can better protect themselves from sophisticated social‑media scams that exploit trust for financial gain.
Original reporting: Fox News (HLL/CB) — read the source article.
