False positive Microsoft 365 Defender alert for URL of 3CXPhoneforWindows16.msi

[Alphabetic]

Any updates?

 

[Charles_3CX]

Hi Charles,
just a short additional info - our 3CX instances are configured to send e-mails out via M365 tenant / Exchange Online
We are experiencing the same issue - when download link for legacy PC client is included, the e-mail gets quarantined.
So the situation affects both receiving e-mails (if recipient is behind M365) and also sending e-mails out vi M365.

Jakub

Yes this wound be expected that if using 365 smtp to send email via the M365 integration option within 3CX, that the welcome email will also be blocked on sending side, MS 365 defender is flagging the URL for the download of the legacy client as malware

We have opened a ticket with Microsoft and we are waiting for their response.

Once an answer is received we will provide an update in this forum post.

 

[cecon-Berlin]

Hi together,
any further informations about?

regards

 

[Charles_3CX]

Hi together,
any further informations about?

regards

We are still waiting for feedback from Microsoft regarding this issue.

Once an answer is received, we will provide an update here.

 

[SteveITS]

I would not hold my breath waiting for it to be resolved quickly. I think it was another thread where I posted that it happened to the support emails from a vendor of ours who provides a PSA for a huge number of IT firms nationwide. I suspect it was related to the "log gathering tool" their support sends out. It was an issue for a month or two as I recall. Bit annoying as they wondered why no one was responding and we wondered why they were ignoring tickets. Microsoft lets one allow the sender address on that web page but it had zero effect...I guess they want to protect you from allowing malware to yourself.

 

[surawoot]

Hi all

We have submitted this to Microsoft for review and awaiting their reply. Once we have an update, we will provide it here.

Hello Charles,

Regarding the situation with the 3cx SMTP server. As you may recall, we have been experiencing some issues with sending and receiving emails using this server.

If you have any update about this situation. Have you been able to resolve the problem or find an alternative solution? I appreciate your efforts and cooperation in this matter.

One possible option that I have been considering is to use Google mail server instead of 3cx SMTP. I have heard that Google mail server is more reliable and secure, and it also offers some features that 3cx SMTP does not have, such as spam filtering and automatic replies.

However, I am not sure if this option is feasible or compatible with our current system. Do you have any experience or knowledge about using Google mail server with 3cx? Do you think it would be a good idea to switch to Google mail server or do you have any other suggestions for a work around on this problem?

Please let me know your thoughts and opinions on this matter as soon as possible. I look forward to hearing from you and working with you to find a solution.

 

[Charles_3CX]

Hello Charles,

Regarding the situation with the 3cx SMTP server. As you may recall, we have been experiencing some issues with sending and receiving emails using this server.

If you have any update about this situation. Have you been able to resolve the problem or find an alternative solution? I appreciate your efforts and cooperation in this matter.

One possible option that I have been considering is to use Google mail server instead of 3cx SMTP. I have heard that Google mail server is more reliable and secure, and it also offers some features that 3cx SMTP does not have, such as spam filtering and automatic replies.

However, I am not sure if this option is feasible or compatible with our current system. Do you have any experience or knowledge about using Google mail server with 3cx? Do you think it would be a good idea to switch to Google mail server or do you have any other suggestions for a work around on this problem?

Please let me know your thoughts and opinions on this matter as soon as possible. I look forward to hearing from you and working with you to find a solution.

We have opened a ticket with Microsoft and are awaiting a reply regarding this issue, currently, I'm afraid we do not have an update or an ETA on when it will be.

 

[SweetAction]

Hello Charles,

Regarding the situation with the 3cx SMTP server. As you may recall, we have been experiencing some issues with sending and receiving emails using this server.

If you have any update about this situation. Have you been able to resolve the problem or find an alternative solution? I appreciate your efforts and cooperation in this matter.

One possible option that I have been considering is to use Google mail server instead of 3cx SMTP. I have heard that Google mail server is more reliable and secure, and it also offers some features that 3cx SMTP does not have, such as spam filtering and automatic replies.

However, I am not sure if this option is feasible or compatible with our current system. Do you have any experience or knowledge about using Google mail server with 3cx? Do you think it would be a good idea to switch to Google mail server or do you have any other suggestions for a work around on this problem?

Please let me know your thoughts and opinions on this matter as soon as possible. I look forward to hearing from you and working with you to find a solution.

Using Google to send the emails will not solve this issue as the recipients are using Microsoft 365 for their email and 365 is the one blocking it, not the sender.

 

[ltri37]

Exactly, changing SMTP server does not solve the problem at all.

 

[Charles_3CX]

Thanks for your patience regarding this matter. We have been informed that the issue is resolved, and welcome emails from 3CX should now be received in 365 mailboxes. There was no issue with the download URL for the 3CX Windows legacy app.

Please try sending a welcome email and let us know if you can now receive it.

 

[ltri37]

I can confirm that at 15:42 UTC the welcome mail got through with the link to the MSI file.

 

[netops]

Thank you for your review and for everyone's input.

We have removed the reference and link from our welcome email templates as we've stopped using the legacy application.

We were concerned the file was being detected as malware and we're happy to hear that the issue has been resolved.

 

[Foneguy01]

So June 30th was the last update on this. Are there any further updates?

 

[Alan9846]

So June 30th was the last update on this. Are there any further updates?

Last update I am seeing (from 3CX) is 1443hrs on 6 Jul 2023 where the issue is noted as resolved.

There is also a reply from 'netops' at 1449 on 6 Jul 2023 noting that it seems to be working for them now.

There is nothing (I can see) to disambiguate the dates and times, so if you are in a foreign country, they might show differently for you, but still way past 30 Jun 2023.

Can you not see anything after 30 Jun 2023?


Alan.

 

[Foneguy01]

I can now, but when I posted it, the last entry was June 30th, now the rest are visible...weird