On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token.

The attack began when the Microsoft account (@Microsoft) followed and reposted a tweet from another now-suspended X account (@clippymsftcto) impersonating Microsoft’s Clippy virtual assistant, The Verge first reported.

While @clippymsftcto has been suspended, another X account (@ClippyMSFT) that reposted Microsoft’s tweet is still promoting a $Clippy crypto token, claiming that it has “has a liquidity pool paired directly with $MSFT.”