According to a ANYRUN report shared with Cyber Security News , this error triggered a sudden influx of Adobe Acrobat Cloud links being uploaded to their sandbox for analysis. “We saw a sudden inflow of Adobe Acrobat Cloud links being uploaded to ANYRUN’s sandbox a couple of hours ago.” “To stop leaks, we’re making all these analyses private, but users continue to share confidential documents publicly. Our team traced it back to a false positive from Microsoft Defender XDR, which mistakenly flagged the following legitimate URL as malicious: acrobat[.]adobe[.]com/id/urn:aaid:sc:” ANY.RUN shared the report with Cyber Security News. The incident began when Microsoft Defender XDR, a widely used advanced threat protection platform, mistakenly flagged legitimate Adobe Acrobat Cloud links specifically URLs starting with acrobat[.]adobe[.]com/id/urn:aaid:sc:—as malicious. In this case, the misclassification by Microsoft Defender XDR prompted users to take actions that inadvertently exposed sensitive data, underscoring the need for accurate threat detection to prevent such cascading effects. ANYRUN’s investigation revealed that the false positive led free-plan users to upload more than 1,700 Adobe files containing confidential data, affecting hundreds of organizations. The report also advised users encountering false positives in Microsoft Defender XDR to submit them to Microsoft for analysis and resolution, a step that could help prevent similar incidents in the future. The leak, which involved corporate data from hundreds of companies, has raised alarm bells about the risks of misclassification in threat detection systems and the unintended consequences of user behavior in response to such errors. As noted in a web report by PUPUWEB on April 24, 2025, false positives can erode trust in detection systems and lead to significant security risks if not addressed promptly. A couple of hours ago we saw a sudden inflow of Adobe Acrobat Cloud links being uploaded to ANYRUN's sandbox. ANY.RUN research identified a large-scale data leak event triggered by a false positive in Microsoft Defender XDR. The ANYRUN incident serves as a stark reminder of how errors in cloud-related security tools can amplify these vulnerabilities, leading to unintended consequences like widespread data exposure. Many of these uploads were initiated by users on ANYRUN’s free plan, which defaults to public sharing mode, inadvertently exposing sensitive corporate documents to the wider internet.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Apr 2025 04:50:09 +0000