Summary
Microsoft’s official X account was compromised and used to promote a cryptocurrency pump-and-dump scheme before the account was recovered. The attackers used Microsoft’s high-follower account to post fraudulent cryptocurrency promotion content designed to artificially inflate a token’s price for rapid liquidation.
Timeline
| Date | Event |
|---|---|
| Oct 3, 2026 | Microsoft X account compromised; cryptocurrency pump-and-dump content posted; account recovered |
What Happened
High-follower social media accounts are targets for cryptocurrency pump-and-dump operators because their large audiences create the rapid price movement needed to execute profitable trades within the short window between account compromise and recovery. The attacker posts cryptocurrency promotion content, accumulates the promoted token before posting, and liquidates their position during the brief price spike caused by the fraudulent post.
Note on Domain Intelligence
This bulletin covers a social media account compromise. No single commercial clearnet domain is the primary subject.