Luna Moth Hits Law Firms Again to Steal Microsoft Tokens
Extortion group Luna Moth is returning to law firms it hit before, likely those that refused to pay. This time it poses as IT support and talks employees into copying their Microsoft access token themselves, with no malware involved.
⚡ Why it matters
The attack needs no vulnerability or malware and bypasses MFA because the employee hands over the token. Awareness is the first defense: IT will never ask you to open developer tools.
According to ReliaQuest, Luna Moth has targeted law firms since at least mid-2023. It is now returning to the same victims weeks or months later, knowing they can be tricked and that law firm client data is highly sensitive.
How the con works
- A blank-subject email from a free account carries a broken PDF posing as a business report, which fails to open.
- Soon after, the attacker calls as IT support about a security alert and offers to fix the PDF (vishing).
- On a video call, the victim is asked to share their screen, open Microsoft Copilot in the browser, open developer tools, find the request to Microsoft Graph and copy the access token.
- The victim pastes the token into a public text-sharing site, and the attacker uses it to download files through the Microsoft Graph API.
Why alarms stay quiet
The token was issued to a compliant device and the user completed a real MFA sign-in. A bearer token works from anywhere until it expires, with a default 60 to 90 minute lifetime, unless Continuous Access Evaluation with strict location enforcement applies.
How to protect your team
- Tell staff plainly that IT will never ask them to open developer tools or copy tokens, and to verify requests by calling back the official help desk.
- Turn on Continuous Access Evaluation (CAE) by default.
- Block developer tools in managed browsers for users who don't need them.
- Restrict remote-support and screen-sharing tools where there is no business need.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
186 Fake AI Domains Spoof ChatGPT, Claude and Gemini
Island uncovered TypoPrompting, a campaign using 186 misspelled domains that impersonate 27 AI brands, including ChatGPT, Claude, Gemini, Copilot, Grok and DeepSeek, to push ClickFix lures, browser hijackers and search-hijacking extensions.
2,539 GitHub Secrets Exposed, Some Saved by Claude Code Settings
Apiiro found 2,539 exposed credentials across nearly 2,000 public GitHub repositories and traced part of them to Claude Code, which saves secret-bearing commands in a settings file that gets committed with the code.
7 Ways to Avoid Fake Meeting Scams and "Audio Fix" Malware
Campaigns like FaceStealer don't exploit a bug; they talk you into downloading a "fix" during a video call. These practical steps shut this kind of attack down.