A notorious extortion group has returned to target law firms that refused to pay its first ransom demand. Luna Moth, a cybercriminal outfit known for preying on law firms, has launched a new social engineering campaign aimed at stealing Microsoft access tokens from unsuspecting victims.
This latest tactic involves the attackers posing as IT staff and tricking targets into giving away sensitive access tokens, which can then be used to access and steal valuable information. According to ReliaQuest Threat Research team’s analysis, Luna Moth has abandoned its previous methods of using remote-management tools and manual exfiltration in favor of this token-theft approach.
The attackers first send a suspicious email with a broken PDF attachment, which fails to open. They then contact the target via phone, posing as IT support, claiming to fix the issue. Once on a video call, they instruct the target to share their screen and navigate to the Microsoft Copilot browser extension. The attacker then guides the target through a series of steps to extract and paste the access token into a public text-sharing site.
This social engineering tactic is particularly effective because it requires no malware or vulnerability exploitation. It relies solely on tricking the target into handing over sensitive credentials, effectively bypassing traditional security controls. ReliaQuest notes that this attack highlights a gap in how organizations scope their controls, assuming that authentication equals ongoing trust.
The use of access tokens as a means to gain unauthorized access to sensitive information is a growing concern for organizations. These tokens are often issued to compliant devices and can be used from anywhere until they expire. However, if not properly enforced with continuous access evaluation (CAE) or token binding, they can become a vulnerability in the organization’s security posture.
To mitigate this risk, ReliaQuest recommends that organizations turn CAE on by default, block browser developer tools and token-inspection pages on managed browsers, and restrict remote-support and screen-sharing tools where there’s no business need. Additionally, employees should be informed about the ways threat actors attempt to steal credentials, and proper training should be provided to recognize and report suspicious activities.
The return of Luna Moth highlights the ongoing threat posed by extortion groups targeting law firms. These organizations often have sensitive client data that can be used for ransom or other malicious purposes. By being aware of these tactics and taking proactive measures to secure their access tokens, organizations can reduce their risk of falling victim to these types of attacks.
Source: Dark Reading — 2026-11-12