Microsoft Defender briefly decided Google Search was malware

Microsoft Defender, the security service included with Office 365, mistakenly flagged Google Search links as potential malware for a short period on September 2. Office 365 customers were unable to open legitimate search links as Redmond's antivirus engine incorrectly identified them as security threats. This incident, tracked as MO1465962, lasted for approximately seven and a half hours before Microsoft resolved the issue.

The problem was caused by inaccurate behavior in Defender's threat-detection process, specifically when handling Google Search URLs included in emails and Microsoft Teams messages. Microsoft Defender's Safe Links feature, designed to protect collaboration and productivity tools from genuine threats, erroneously blocked access to those URLs across affected apps and external browsers.

The company acknowledged that Safe Links is supposed to block phishing, malware, and other genuine dangers, but the misclassification of routine Google Search links was inappropriate. Microsoft stated that its developers are reviewing the URL reputation classification process to prevent similar false positives in the future. While the full scope of the incident remains unclear, Microsoft's advisory suggests the issue was relatively contained.

This latest false positive adds to the growing list of problems plaguing Microsoft Defender, which has a history of negatively impacting system performance, misidentifying legitimate drivers, and exacerbating software issues. Although Defender is free for Windows users, the reliability issues and security concerns associated with the software raise questions about its overall value.