OAK — OnChain Attack Knowledge

Worked example · 2026-10

Microsoft's X account — a hijacked corporate account promoted a "CLIPPY" token riding the MSFT ticker — Microsoft (@Microsoft on X) / token chain not reported — 2026-10-01

Loss
not reported. A promoter account cited CLIPPY liquidity pools "over $200,000"; buyer losses are unquantified. Some promoters claimed the pools were backed by Microsoft shares; that is unverified and Microsoft denies any connection.
OAK Techniques observed
OAK-T15.006 (Impersonation via Verified Social-Account Compromise — primary. Microsoft confirmed "unauthorized access to our account on X, including posts that did not come from Microsoft." The access vector is undisclosed. See techniques/T15.006-impersonation-via-verified-social-account-compromise.md). OAK-T3.004 (Influencer-Amplified Promotion and Dump — the account's reach was the asset being used).
Attribution
unattributed.
Key teaching point
The reach of a corporate account is a liquidity source for whoever controls it for thirty minutes. The same pattern as the SEC account in 2024: the brand needs no crypto exposure for its account to be worth hijacking for a token pump.

Summary

On 2026-10-01 Microsoft's official X account posted promotions for CLIPPY, an unofficial meme coin playing on Clippy and the MSFT ticker. The posts were removed; an apology appeared about 30 minutes later and was itself quickly deleted. Microsoft said the account was secured, that it never authorised use of its IP for a token, and that it would pursue removal of the token and its marketing.

Root-cause evidence

Public references

Techniques demonstrated (2)