Microsoft's X Account Compromised in Crypto Pump-and-Dump Scheme

On October 2, 2026, unknown attackers hijacked the official Microsoft account on X (formerly Twitter), which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a cryptocurrency token. The account posted promotional content for the token, leveraging Microsoft's verified status to lend apparent credibility to the fraudulent investment opportunity.

Microsoft confirmed the compromise in a statement, noting that the account was temporarily taken over by unauthorized parties. The company said it was working with X platform security teams to regain control and secure the account. X platform representatives also confirmed the incident, stating that the account was used to post content promoting a cryptocurrency token as part of a coordinated pump-and-dump operation.

The exact method by which the attackers gained access to the account has not been specified in initial reports. The incident does not appear to involve malware, software exploits, or zero-day vulnerabilities. Instead, it represents a case of account compromise, potentially through credential theft, session hijacking, or social engineering targeting account credentials or recovery mechanisms.

Followers of the Microsoft account were potentially exposed to promotional content for the fraudulent token. The incident raises concerns about the security of high-profile social media accounts and the risk of bad actors using compromised verified accounts to lend legitimacy to cryptocurrency scams. Microsoft and X have been contacted for further details on the compromise method and any steps taken to prevent recurrence.

Security experts note that this incident highlights the importance of strong account security measures, including multi-factor authentication, for high-profile social media accounts. The focus for affected users is on avoiding engagement with promoted cryptocurrency content and being cautious of investment opportunities promoted through verified accounts that may have been compromised.