> ## Content Index
> Fetch the complete content index at: https://www.cyberdelegate.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Luna Moth Returns to Law Firms, Hijacks Microsoft 365 Tokens via Video‑Call Scam
- URL: https://www.cyberdelegate.com/luna-moth-returns-to-law-firms-hijacks-microsoft-365-tokens-via-video-call-scam/
- Published: 2026-11-13T19:42:28.000Z
- Updated: 2026-11-13T19:42:28.000Z
- Description: Luna Moth extortionists are stealing Microsoft Graph tokens from lawyers on video calls, enabling bulk data theft from Office 365 without MFA.
- Author: The CyberDiplomat
- Tags: Ransomware & Data Breaches, Global, extortion, Microsoft365, social engineering, law firms, data breach, #crawler

Luna Moth, a data-extortion group, has revived attacks on law firms that previously ignored its ransom demands. The campaign, first noted in mid‑2023, now uses a deceptive video‑call technique to steal Microsoft Graph access tokens, giving the attackers access to the firms’ Microsoft 365 environments.

## How the token‑theft works

Victims are coaxed into a screen‑sharing session where the attacker pretends to provide technical assistance. Using the browser’s developer tools, the attacker guides the lawyer to locate a Microsoft Copilot token and copy it. The token is then pasted into a public text‑sharing site, where the criminals retrieve it and run it from their own infrastructure.

Because the token authenticates directly to Microsoft Graph, it bypasses multi‑factor authentication (MFA) and Conditional Access policies. The stolen credential remains active for 60‑90 minutes and can be used from any location, allowing bulk download of files from the victim firm's Microsoft 365 services.

## Why law firms are targeted again

The group appears to be revisiting firms that did not pay the initial ransom demand. By stealing tokens instead of deploying remote‑management tools, attackers avoid detection signatures associated with typical ransomware payloads. The stolen data likely includes confidential client communications, case files and personal identifiers, raising the risk of secondary phishing or identity‑theft attacks.

## Mitigation steps for firms and their clients

ReliaQuest advises organisations to enable Continuous Access Evaluation (CAE) with strict location enforcement by default, block developer tools on managed browsers, and limit the use of remote‑support or screen‑sharing applications. Implementing these controls can invalidate stolen tokens outside approved locations and reduce the attack surface.

Clients of the affected law firms should be alert for unsolicited emails that reference recent legal matters, especially those asking for login credentials or payment information. Changing passwords on any accounts that may have been linked to the firm’s Microsoft 365 tenant and monitoring credit reports for unusual activity are prudent steps.

## Broader implications

This tactic demonstrates how social engineering can bypass even strong authentication mechanisms when users are tricked into exposing tokens directly from their browsers. Organizations that rely heavily on cloud collaboration tools must reassess policies around screen sharing, developer‑tool access, and token lifetimes to prevent similar compromises.

### Sources

- [reliaquest.com (official)](https://reliaquest.com/blog/threat-spotlight-luna-moth-returns-re-targeting-law-firms-through-access-tokens/?ref=cyberdelegate.com)
- [Dark Reading](https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time?ref=cyberdelegate.com)

*This brief was prepared with AI assistance from the sources above and reviewed by our editors.*