Microsoft Defender False Positives Are Blocking Google Search URLs

Microsoft Defender for Office 365 is incorrectly blocking legitimate Google search links after Safe Links started classifying some URLs as malicious.

Microsoft is investigating the issue under incident MO1465962. Affected users may see an “Opening this website might not be safe” warning when opening Google search URLs.

Microsoft says an inaccurate security classification is triggering the warnings.

Copying Google links does not bypass the warning

Users reportedly cannot avoid the warning by copying an affected Google search URL and pasting it directly into a browser.

Safe Links checks URLs when users open them and can rewrite links to route them through Microsoft’s security service. Defender for Office 365 applies the protection across email, Microsoft Teams, and supported Microsoft 365 apps.

The current problem means legitimate Google search links can trigger the same warning that Safe Links normally displays for potentially dangerous websites.

Admins may see false Defender alerts

The incorrect classification can also create additional work for IT administrators.

Microsoft says administrators may receive related alerts and incidents in the Microsoft Defender portal. Microsoft Sentinel may also generate security alerts because it sees the affected links as potential threats.

Microsoft is working to correct the classification and restore normal access to the affected Google search URLs.

Microsoft has not disclosed the full scope

Microsoft has not said which regions the Defender for Office 365 issue affects or how many organizations have encountered it.

The company currently lists the incident as an advisory, which generally points to a more limited service impact.

Microsoft has not provided additional details about when it expects the Google search link classification problem to be fully resolved.

In other security news, thousands of Exchange Servers are vulnerable to a major security flaw, while Microsoft is also warning about a fake Cloudflare CAPTCHAs malware campaign.

Via BleepingComputer