- Microsoft was flagging some legitimate Adobe emails as spam
- The company blamed it on an error with its machine learning model
- The issue now appears to be fixed
Microsoft has fixed an annoying bug where a machine learning model in Exchange Online had been mistakenly flagging legitimate Adobe emails as spam.
The errneous spam flagging was relatively short-lived, spanning a two-day period between April 22 at 9:04 AM UTC and April 24 at 11:04 AM UTC.
It’s believed the company’s machine learning model wrongly flagged emails due to their similarity with spam emails, and particularly affected emails containing Adobe URLs.
Adobe emails are no longer being marked as spam
“We’ve determined our machine learning (ML) model, which safeguards Exchange Online against risky email messages, was incorrectly identifying legitimate email messages as spam due to their similarity to email messages used in spam attacks, which was resulting in impact,” Microsoft explained.
The mishap was detailed in an advisory on the Microsoft 365 admin center under the EX1061430 tag (via Bleeping Computer).
Coinciding with Microsoft’s erroneous flagging, malware analysis service ANY.RUN recorded a sharp rise in the number of Adobe Acrobat Cloud links for personal documents that were being submitted by Microsoft Defender XDR.
ANY.RUN shared on X: “After research, we’ve discovered that Microsoft Defender XDR mistakenly flagged acrobat[.]adobe[.]com/id/urn:aaid:sc: as malicious.”
“To fix the issue we initiated Replay Time Travel (RTT) on the affected URLs to fully remediate impact. Impact was specific to some users who were served through the affected infrastructure,” Microsoft added.
ANY.RUN noted the unintented consequences created by a combination of its services, Defender XDR and Microsoft’s machine learning mistake. Because legitimate URLs linking to personal and work documents were being submitted to ANY.RUN, the service saw users “upload more than a thousand Adobe files with sensitive corprorate data of hundreds of companies.”
“To stop leaks, we’re making all these analyses private,” ANY.RUN confirmed.
