Luna Moth Extortion Group Targets Law Firms Again with Token Theft Scheme
The Luna Moth extortion group has resurfaced, targeting law firms that previously refused to pay ransoms with a new social engineering tactic focused on stealing Microsoft access tokens.
The notorious Luna Moth extortion group has launched a renewed offensive against law firms, marking a second wave of attacks against organizations that previously resisted their demands. This latest campaign, detailed by ReliaQuest Threat Research, abandons the group's previous reliance on remote-management tools and manual data exfiltration. Instead, Luna Moth is now employing sophisticated social engineering tactics to trick victims into divulging Microsoft access tokens, which are then used to gain unauthorized access and steal sensitive information.
This shift in methodology is particularly concerning as it bypasses traditional security measures that might flag malware or exploit attempts. The attackers initiate contact through emails with a non-descript subject line, often containing a broken PDF file. This serves as a pretext for a follow-up call, where the threat actor impersonates IT support personnel responding to a supposed technical issue with the document. The goal is to gain the victim's trust and guide them through a series of steps that ultimately lead to the compromise of their credentials.
During a video call, the imposter IT support agent instructs the victim to enable screen-sharing. Under the guise of fixing the PDF issue, the attacker directs the victim to open Microsoft Copilot via a web browser. The crucial step involves the victim accessing the browser's developer tools, locating a specific request made by Copilot to Microsoft Graph, and then copying the associated access token. This token, essentially a master key, is then shared with the attacker, often via a public text-sharing site, granting them unfettered access to the organization's data through the Microsoft Graph API.
The effectiveness of this attack lies in its reliance on human psychology rather than technical exploits. By posing as helpful IT staff, Luna Moth exploits the natural inclination of employees to resolve technical problems. This tactic, reminiscent of 'ClickFix' schemes, requires no malware installation or exploitation of software vulnerabilities. The organization's own systems and user actions are leveraged to facilitate the breach.
ReliaQuest highlights that this attack reveals a critical gap in how organizations scope their security controls. Because the access token is issued to a compliant device and handed over by the user, it often bypasses security alerts. Tokens, being bearer credentials, can be used from anywhere until they expire, and without strict Continuous Access Evaluation (CAE) policies or token binding, they present a significant risk. The default token lifetime in Microsoft environments, often 60-90 minutes, further exacerbates this vulnerability.
To mitigate such threats, ReliaQuest recommends several key security enhancements. Organizations should enable CAE by default, restrict the use of browser developer tools and token-inspection pages on managed browsers, and limit the deployment of remote support and screen-sharing tools to only essential business needs. Crucially, employees must be educated about these evolving social engineering tactics, with clear guidance that IT support will never request developer tools or access tokens directly. Verifying IT requests through a separate, trusted channel, such as a callback to a known IT department number, is paramount.
This renewed focus on law firms underscores their continued attractiveness as targets due to the highly sensitive nature of client data. The severe reputational damage and potential financial losses associated with data breaches make them prime candidates for repeated extortion attempts. Luna Moth's adaptation to token-based attacks signifies an evolving threat landscape where human trust is the primary vector for compromise.