CampaignPublished 12 Nov 2026

Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens

Source AlienVault OTX General

Description

The Luna Moth extortion group is targeting law firms using a novel attack that steals Microsoft Graph access tokens from Microsoft 365 Copilot via social engineering. Attackers impersonate IT support in video calls to convince victims to extract tokens through browser developer tools. These tokens bypass MFA and Conditional Access because validation only occurs at issuance, allowing attackers to download large volumes of files within about an hour. This method avoids malware and endpoint detection, representing a shift toward identity-focused attacks. Organizations are advised to implement Continuous Access Evaluation with strict location enforcement to invalidate tokens used outside authorized networks.

Impact

The attack allows adversaries to bypass multi-factor authentication and Conditional Access controls by stealing valid Microsoft Graph access tokens. This enables unauthorized bulk data exfiltration from targeted law firms within a short timeframe (approximately one hour). The technique avoids malware deployment and endpoint detection, increasing the likelihood of successful data theft and extortion. The simplification of the attack chain reduces the complexity and potential detection opportunities for defenders.

Defensive guidance

Organizations should implement Continuous Access Evaluation with strict location enforcement to invalidate access tokens used outside authorized networks. This measure directly addresses the token misuse technique employed by Luna Moth. Since the attack relies on social engineering to extract tokens, user awareness training about impersonation and suspicious requests is also advisable. No patches are applicable as this is an attack technique rather than a software vulnerability.

Indicators of compromise

Domains 1

justsendtext.xyz

IP addresses 1

CC=US ASN=AS19318 interserver inc

104.37.184.195

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Nov 2026, 10:03 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 1

Community reviews

Related threats