Microsoft has confirmed that a faulty anti-phishing detection rule designed to stop credential theft campaigns mistakenly blocked thousands of legitimate emails and Teams messages for nearly a week.<\/p>\n
The disruption affected customers using Exchange Online and Microsoft Teams,<\/strong> two key services within the company\u2019s Microsoft 365 ecosystem.<\/p>\n According to Microsoft\u2019s preliminary post-incident report, the incident tracked internally as EX1227432 began on February 5 and was fully resolved on February 12.<\/p>\n The Root Cause<\/strong><\/p>\n The root cause was a logic error in a heuristic detection system meant to identify new and emerging credential phishing campaigns. Shortly after the detection rules were updated, it began incorrectly flagging legitimate URLs as phishing links at a much higher rate than intended.<\/p>\n “This issue occurred due to a logic error in a heuristic detection aimed at novel credential phishing campaigns that spiked several hours after release,” Microsoft explained.<\/p>\n A Cascade Of Automated Reactions<\/strong><\/p>\n Since Microsoft\u2019s security infrastructure is highly automated, the faulty detection triggered automated security responses, including:<\/p>\n Other security tools within Microsoft\u2019s detection ecosystem amplified the flawed rule\u2019s effects. To make matters worse, a separate bug in the company\u2019s security signature systems delayed efforts to roll back the faulty detection mechanism.<\/p>\n In simple terms, one mistake triggered a chain reaction across multiple automated defenses \u2014 making the issue more widespread and slower to fix.<\/p>\n How It Affected Users<\/strong><\/p>\n During the affected period, users across Microsoft Exchange Online and Microsoft Teams experienced disruptions in routine communication.<\/p>\n Many users found they could not open links in routine emails or Teams chats. In some cases, emails were completely quarantined. IT administrators faced confusion as dashboards showed warning alerts suggesting suspicious activity \u2014 alerts Microsoft later confirmed were false positives.<\/p>\n While the total number of impacted users has not been disclosed, the company classified the event as an \u201cincident,\u201d a label typically reserved for issues with widespread customer impact.<\/p>\n Not the First Email Filtering Issue<\/strong><\/p>\n This is not the first time Microsoft has faced such automated email defenses in recent years. Previously, an Exchange Online bug caused legitimate emails from Gmail accounts \u2014 including messages from Gmail accounts \u2014 to be wrongly marked as spam or malicious.<\/p>\n As recently as September, another anti-spam service issue blocked URLs and quarantined some emails in both Exchange Online and Teams.<\/p>\n Separately, Microsoft is also working to fix a bug in Microsoft 365 Copilot Chat, which, since late January allowed confidential emails to be summarized in certain cases.<\/p>\n What Happens Next?<\/strong>\u00a0<\/strong><\/p>\n Microsoft says it will release a final post-incident report within five business days of full resolution. It added that it is working to prevent similar incidents in the future.<\/p>\n For now, Microsoft says the faulty detection rules have been corrected, and affected services are operating normally. Users should no longer experience blocked links or unexpected quarantines tied to this issue.<\/p>\n The incident highlights how difficult it is for major cloud companies to maintain strong security defenses without accidentally blocking the normal emails and messages that businesses depend on every day.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft has confirmed that a faulty anti-phishing detection rule designed to stop credential theft campaigns mistakenly blocked thousands of legitimate emails and Teams messages for nearly a week. The disruption affected customers using Exchange Online and Microsoft Teams, two key services within the company\u2019s Microsoft 365 ecosystem. According to Microsoft\u2019s preliminary post-incident report, the incident […]<\/p>\n","protected":false},"author":20,"featured_media":128567,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91,3141],"tags":[64955,1276,64956,64907,64957,6765,6794,60620,64172,54714,504,64954],"class_list":{"0":"post-128562","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-microsoft","8":"category-news","9":"tag-anti-phishing","10":"tag-emails","11":"tag-ex1227432","12":"tag-exchange-online","13":"tag-false-positive","14":"tag-gmail","15":"tag-microsoft","16":"tag-microsoft-365","17":"tag-microsoft-exchange-online","18":"tag-microsoft-teams","19":"tag-phishing-2","20":"tag-teams-messages"},"yoast_head":"\n\n