Microsoft Says Faulty Phishing Detection Blocked Legitimate Exchange and Teams Links
Summary
Microsoft says a logic error caused Exchange Online and Teams to block legitimate URLs and messages from February 5 to 12. The issue, tracked as EX1227432, triggered false alerts; Microsoft plans a final report.
Key points
- Microsoft attributed the issue, tracked as EX1227432, to a logic error in heuristic detection for novel credential-phishing campaigns.
- From February 5 to 12, thousands of legitimate URLs were incorrectly flagged, blocking links in Exchange Online emails and Teams messages.
- Automated protections removed some messages, quarantined emails, and generated false alerts about potentially malicious URL clicks.
- Other detection tools amplified the impact, while a separate security-signature-system bug delayed rollback of the flawed rules.
- Microsoft had not disclosed the total number of affected users and said it would publish a final report within five business days of resolution.
Article Details
- Event Type
- Service disruption caused by a false-positive anti-phishing detection error
- Impact
- From February 5 to February 12, Exchange Online and Microsoft Teams incorrectly blocked links in messages after legitimate URLs were misclassified as phishing. Some emails and Teams messages were removed or quarantined, and administrators received false alerts. Microsoft has not disclosed the number of affected users.
Vendors
Products
Exchange OnlineMicrosoft confirmed that a logic error in Exchange Online’s heuristic detection for credential phishing incorrectly flagged thousands of legitimate URLs as phishing, blocking links in emails and Microsoft Teams messagesMicrosoft Teamsphishing incorrectly flagged thousands of legitimate URLs as phishing, blocking links in emails and Microsoft Teams messages between February 5 and February 12.