​Microsoft is working to resolve a known issue that causes an anti-spam service to mistakenly block Exchange Online and Microsoft Teams users from opening URLs and quarantine some of their emails.

In a service alert seen by BleepingComputer, the company stated that the issue is caused by the anti-spam engine incorrectly tagging URLs contained within other URLs as potentially malicious, which has also led to some emails being quarantined.

The issues began impacting Exchange Online and Microsoft Teams users on September 5th, when Redmond said that admins might see alerts titled “A potentially malicious URL click was detected involving one user,” even though the URLs had already been confirmed as safe.

“We’ve identified over 6,000 URLs that are affected and are working to unblock them before replaying messages to recover any messages or URLs that were incorrectly flagged,” Microsoft said the day it discovered the bug.

“Redmond’s engineers have deployed a fix that addresses these problems by ensuring that the syncs no longer enter the quarantine state, after a previous configuration change that would’ve changed the configured delay interval to one hour wasn’t successful.”

While Microsoft engineers have partially resolved these false positive issues, they are still working to address the impact caused by more URLs being disabled by its faulty anti-spam models.

“We’ve identified a new subset of URLs that are impacted and we’re working to address the new set and any residual impacted messages. We are confident that a majority of the impact has been resolved, and we’re actively addressing lingering impact while we perform our root cause analysis,” the company added in a September 8th update.

Although the company has yet to disclose the number of customers or the regions affected by these ongoing anti-spam problems, this service issue has been classified as an incident, which usually involves noticeable user impact.

Microsoft has addressed similar issues since the start of the year, resulting in emails being incorrectly tagged as spam or quarantined. For instance, in May, Microsoft resolved another issue causing a machine learning model to incorrectly flag emails from Gmail accounts as spam in Exchange Online.

Redmond fixed another machine-learning bug that mistakenly flagged Adobe emails in Exchange Online as spam one month earlier, as well as an Exchange Online false positive that caused anti-spam systems to incorrectly quarantine some users’ emails in March.

Threat actors are using Grok, X’s built-in AI assistant, to bypass link posting restrictions that the platform introduced to reduce malicious advertising.

As discovered by Guardio Labs’ researcher Nati Tal, mavertisers often run sketchy video ads containing adult content baits and avoid including a link to the main body to avoid being blocked by X.

Instead, they hide it in the small “From:” metadata field under the video card, which apparently isn’t scanned by the social media platform for malicious links.

Next, (likely) the same actors ask Grok via a reply to the ad something about the post, like “where is this video from,” or “what is the link to this video.”

Grok parses the hidden “From:” field and replies with the full malicious link in clickable format, allowing users to click it and go straight to the malicious site.

Because Grok is automatically a trusted system account on the X platform, its post boosts the link’s credibility, reach, SEO, and reputation, increasing the likelihood that it will be broadcast to a large number of users.

The researcher has found that many of these links funnel through shady ad networks, leading to scams such as fake CAPTCHA tests, information-stealing malware, and other malicious payloads.

Instead of being blocked by X, they are instead promoted to users on the platform via malicious ads that receive a further boost from Grok.

Tal calls the technique of exploiting this loophole “Grokking,” and notes that it’s very effective, in some cases amplifying malicious ads to reach millions of impressions, as shown below.

Potential solutions include scanning all fields, blocking hidden links, and adding context sanitization to Grok, so the AI assistant does not blindly echo links when asked by users, but instead filters and checks them against blocklists.

Tal confirmed to us that he has contacted X to report the issue and received unofficial confirmation that Grok engineers received the report. 

BleepingComputer has also contacted X to ask if they’re aware of this abuse and whether they plan to do anything about it, but we received no response by publication time.

Cointelegraph, one of the leading crypto media platforms, has confirmed a front-end security breach that exposed its users to a malicious pop-up urging them to connect their wallets.

The incident, which occurred on June 22, involved scammers promoting a fake Cointelegraph token (CTG) and a counterfeit initial coin offering (ICO) campaign.

Scam Sniffer, a blockchain security platform, first flagged the compromise, noting that the attackers aimed to deceive users into granting wallet access. Once connected, these wallets could be drained of assets.

Scam Sniffer traced the exploit to a JavaScript payload embedded via the site’s advertising infrastructure. The code appeared to come from a domain resembling AdButler, though it had been recently registered and linked to a malicious script hidden within a banner advertisement.

In a public statement, Cointelegraph acknowledged the issue and warned users not to interact with pop-ups promoting “CTG tokens” or “CoinTelegraph ICO airdrops.”

The platform emphasized that it is actively investigating and working to remove the malicious code. Users were advised not to enter personal details or connect wallets to any prompts on the site.

CoinMarketCap faced similar exploits

This incident follows a similar attack on CoinMarketCap just two days prior.

On June 20, the crypto data provider briefly experienced a front-end breach that resulted in a fake wallet prompt appearing on its homepage.

CoinMarketCap traced the vulnerability to a doodle image linked to unauthorized JavaScript, which briefly disrupted the site’s interface. It noted:

“Our security team identified a vulnerability related to a doodle image displayed on our homepage. This doodle image contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users when visited our homepage.”

While the message on each site differed, both cases followed a near-identical delivery mechanism: a deceptive pop-up disguised as a platform feature. This may indicate a coordinated campaign targeting high-traffic crypto websites using ad-based JavaScript exploits.

Security experts pointed out that the twin breaches highlight a growing trend of attackers exploiting trusted platforms to execute wallet-draining schemes. As a result, they urged crypto users to remain cautious, avoid interacting with unknown dApps, and regularly monitor wallet activity to stay safe.

Mentioned in this article

The Taiwanese cryptocurrency exchange BitoPro claims the North Korean hacking group Lazarus is behind a cyberattack that led to the theft of $11,000,000 worth of cryptocurrency on May 8, 2025.

The company has attributed the attack to Lazarus based on the evidence recovered from its internal investigations. It notes that the attack patterns and methodology closely resemble those used in past cyberattacks.

“The attack methodology bears resemblance to patterns observed in multiple past international major incidents, including illicit transfers from global bank SWIFT systems and asset theft incidents from major international cryptocurrency exchanges,” reads the announcement.

“These attacks are attributed to the North Korean hacking organization Lazarus Group.”

BitoPro is a cryptocurrency exchange that caters primarily to Taiwanese users, supporting fiat deposits and withdrawals in TWD and a selection of crypto assets.

It has over 800,000 registered users and a daily trading volume of roughly $30 million.

On May 8, 2025, during a hot wallet system update, hackers performed unauthorized withdrawals from an old hot wallet across multiple blockchains, including Ethereum, Tron, Solana, and Polygon.

After the theft, stolen funds were laundered through DEXs and mixers like Tornado Cash, ThorChain, and Wasabi Wallet.

BitoPro was slow in admitting the incident, only confirming it publicly on June 2, noting that all operations were unaffected and impacted hot wallets were replenished by available reserves.

The investigation into the hack now confirmed that there was no internal involvement, even though the attackers launched a social engineering attack and implanted malware on the device of an employee managing cloud operations.

Through this infection, the attackers hijacked AWS session tokens to bypass multi-factor authentication (MFA) and gain control over BitPro’s cloud infrastructure.

Next, the command-and-control (C2) server delivered commands to the implant that injected scripts into the hot wallet host as the attack was being prepared.

When the wallet was upgraded and assets transferred, the attackers stole crypto while simulating normal operational behavior to evade immediate detection.

Once BitoPro detected the compromise, they shut down the hot wallet system and rotated the cryptographic keys. However, roughly $11 million worth of cryptocurrency had already been stolen.

The company informed the applicable authorities and engaged with an external cybersecurity expert to investigate the incident, a process completed on June 11.

The North Korean Lazarus group is notorious for targeting cryptocurrency and decentralized finance entities. The hacking group is believed to be responsible for record-breaking digital asset heists, most recently, the $1.5 billion theft from Bybit.

Google says an API management issue is behind Thursday’s massive Google Cloud outage, which disrupted or brought down its services and many other online platforms.

Google says the cloud outage started around 10:49 ET and ended at 3:49 ET, after causing issues for millions of users worldwide for over three hours.

Besides Google Cloud, the incident also impacted Gmail, Google Calendar, Google Chat, Google Cloud Search, Google Docs, Google Drive, Google Meet, Google Tasks, Google Voice, Google Lens, Discover, and Voice Search.

However, it also caused widespread issues for third-party platforms that rely on Google Cloud, including but not limited to Spotify, Discord, Snapchat, NPM, Firebase Studio, and a limited number of Cloudflare services relying on the Workers KV key-value store.

“We are deeply sorry for the impact to all of our users and their customers that this service disruption/outage caused. Businesses large and small trust Google Cloud with your workloads and we will do better,” Google said.

While it’s still working on publishing a full incident report, Google revealed today the root cause of what caused an increased number of 503 errors in external API requests during yesterday’s three-hour-long outage.

As the company explained today, its Google Cloud API management platform failed due to invalid data, an issue that wasn’t discovered and remediated promptly because it lacked effective testing and error-handling systems.

“From our initial analysis, the issue occurred due to an invalid automated quota update to our API management system which was distributed globally, causing external API requests to be rejected. To recover we bypassed the offending quota check, which allowed recovery in most regions within 2 hours,” the company added.

“However, the quota policy database in us-central1 became overloaded, resulting in much longer recovery in that region. Several products had moderate residual impact (e.g. backlogs) for up to an hour after the primary issue was mitigated and a small number recovering after that.”

Cloudflare services taken down by Google’s outage

After successfully restoring its own impacted services, Cloudflare also revealed in a post-mortem that yesterday’s incident was not caused by a security incident and that no data was lost.

“The cause of this outage was due to a failure in the underlying storage infrastructure used by our Workers KV service, which is a critical dependency for many Cloudflare products and relied upon for configuration, authentication, and asset delivery across the affected services,” Cloudflare said.

“Part of this infrastructure is backed by a third-party cloud provider, which experienced an outage today and directly impacted the availability of our KV service.”

Even though it didn’t share the name of the cloud provider behind the Thursday outage, a Cloudflare spokesperson told BleepingComputer yesterday that only Cloudflare services relying on Google Cloud were affected.

In response to this incident, Cloudflare says it will migrate KV’s central store to its own R2 object storage to reduce external dependency and prevent similar issues in the future.

Amid today’s market correction, ChainLink (Link) has lost its recent profits and has returned to a critical level of support. Analysts suggest that monthly ranges above the current range can place cryptocurrencies at a 35% spike.

Related readings

ChainLink Retest Important Price Range

ChainLink has once again retested its $14 major support zone, 9.1% down in the last 24 hours. Cryptocurrency surged 15.7% from its low last Friday, hitting an 18-day high of $16 on Wednesday, instantly recovering 35% from this month’s low.

However, a recent market correction has halted most cryptocurrency momentum, returning Bitcoin (BTC) to immerse itself in the $83,700 mark and Ethereum (ETH) in a $1,860 support zone.

Today, Link fell from $15 to $14.07, losing all of its profits on Wednesday. Previously, analyst Ali Martinez noted that cryptocurrencies have been in ascending parallel channels since July 2023.

ChainLink hovered between the upper and lower boundaries of the pattern for half last year, surged to the upper trendlines of the channels with each retesting the lower zone.

Among recent price performance, cryptocurrencies have retested the lower limit of the channel, suggesting that bounces to the higher range could occur if they hold current price levels.

Meanwhile, Rekt Capital highlighted that it is testing a multi-month symmetric triangle pattern where tokens can determine the next move in cryptocurrency.

As analysts explained, Chainlink was integrated within the “macro triangle market structure” for most of 2024, before breaking out of the pattern during the November market rally.

During the breakout in the fourth quarter of 2024, cryptocurrency reached a two-year high of $30.9, but failed to hold this level in the next few weeks. As a result, the price of the link has returned to the Macro Triangle and has been on a downtrend for the past three months.

“The main goal of the link here is to retest the top of the pattern to ensure a successful post-split retest,” Rekt Capital elaborated, “This could be a volatile post-breaking retest.”

Links must maintain this level

Rekt Capital pointed out that historically ChainLink has deviated from the downside of this price range.

Nevertheless, cryptocurrency deviates from “but the actual candle body is in the form of a closure rather than a downside wick.”

Analysts also emphasize that, as in 2021, the link has traded for around $13-5-$15.5 within historical demand areas, testing this zone as support. Based on this, cryptocurrency must successfully hold this territory and “position itself for future rises.”

Related readings

Furthermore, retesting is key to regaining the top of the triangle market structure. Destroying and restoring that level will make it accurate for “successful post-destruction retest” and allow it to target a price of $19 in the future.

Analysts concluded that once the link closes one month above the top of the triangle, “positioning prices to ensure a successful retest despite the negative deviation.”

At the time of writing, ChainLink is trading at $14.09, a 6.9% decrease in monthly time frames.

Unsplash.com featured images, tradingView.com charts

Blockchain investigator ZachXBT has exposed the trader behind a series of high-risk trades on Hyperliquid, linking the activity to a UK-based individual with a history of financial crimes.

ZachXBT revealed on March 20 that the trader is allegedly William Parker, a UK citizen previously convicted of financial crimes in Finland and the UK.

Parker gained market attention after executing aggressive leveraged trades on Hyperliquid between January and March. The crypto whale claimed these trades had secured nearly $20 million in profits.

However, ZachXBT publicly accused the trader—who operates under the X handle @qwatio and the alias MELANIA—of engaging in cybercriminal activities. By the next day, Parker responded on X, denying the accusations and refuting claims that he funded his trades with stolen assets.

According to Parker:

“[ZachXBT] is wrong here. Interested to donate but by his logic he would be labelled a scammer if we do. Big problem – ability to taint an address by dusting.”

Digital trail exposes illicit links

In a detailed social media post, ZachXBT’s investigation traced Parker’s blockchain activity across significant platforms like Binance, Roobet, and Alphapo.

His analysis also suggested Parker’s X account was likely purchased, given its recent name change, prolonged inactivity, and age.

Further scrutiny revealed deeper ties to fraudulent activities. One of Parker’s followed accounts, CryptxxCatalyst, was linked to phishing scams.

The crypto investigator pointed out that blockchain records showed that in January 2025, he manipulated a casino game and targeted phishing victims.

A wallet associated with him received funds from these scams, including a $17,100 transaction. That same address was flagged as a drainer fee receiver in another exploit.

His gambling habits provided more clues. Withdrawals from four Solana-based casinos were traced to his Telegram details, helping the investigator confirm his identity.

ZachXBT also tracked a recent transaction from wallet 0xe4d3 linked to a UK phone number publicly registered under William Parker.

According to ZachXBT, Parker’s criminal history dates back over a decade. In 2023, Finnish authorities convicted him of stealing $1 million from two casinos.

Before that, he was known as Alistair Packover, later changing his name to William Peckover. In the early 2010s, he made headlines in the UK for fraud charges tied to hacking and gambling.

ZachXBT concluded:

“It is abundantly clear WP/AP has not learned his lesson over the years after serving time for fraud and will likely continue gambling.”

According to Arkham Intelligence data, a wallet associated with Parker currently holds over $23 million in digital assets.

Mentioned in this article

OKX has temporarily suspended its Web3 decentralized exchange (DEX) aggregator following discussions with European regulators.

The exchange announced this decision on March 17, stating that the move is part of efforts to enhance security measures and prevent misuse of its platform.

Bybit hack connection

The suspension comes as European authorities investigate allegations that hackers linked to North Korea’s Lazarus Group used OKX Web3 to launder funds stolen in the recent Bybit hack.

A recent Bloomberg report suggested regulators from all 27 European Union nations discussed this issue during a European Securities and Markets Authority (ESMA) meeting on March 6.

Bybit CEO Ben Zhou confirmed that the hackers leveraged OKX Web3 to launder approximately $100 million of the stolen $1.5 billion.

In response, EU regulators are now assessing whether the platform falls under the jurisdiction of the Markets in Crypto-Assets (MiCA) regulatory framework and exploring possible penalties for OKX.

OKX’s response

OKX maintains that its involvement in the laundering process was due to incorrect labeling by blockchain explorers and other decentralized exchanges.

The exchange stated that it is actively working with these explorers to ensure accurate transaction reporting and prevent misidentification of its aggregator as the point of trade.

It explained:

“We know that transparency is key, so we’re also working closely with blockchain explorers to correct incomplete labeling. Our goal is to ensure that explorers properly highlight the actual DEX processing trades rather than mistakenly identifying our aggregator as the point of trade.”

The platform also reiterated that its aggregator does not custody user assets but merely provides access to liquidity across multiple decentralized protocols.

To further strengthen security, the platform has introduced a system designed to detect hacker addresses in real time and block them from accessing its centralized exchange.

OKX CEO Star Xu said on X:

“We already rolled out a lot of controls for OKX Web3 to fight with the misuse including prohibited markets’ ip blocking and real-time black address detection and blocking system.”

Mentioned in this article