Luna Moth returns to law firms with Microsoft token social engineering

Tier D · Background noise – Good to know

Who’s exposed: Law firms that refused Luna Moth's first ransom

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild

The Brief

The extortion group Luna Moth is targeting law firms again, after the same firms refused to pay its first ransom.
The new campaign uses social engineering to steal Microsoft access tokens.
The source describes this as a return of the group's earlier attacks on law firms.

Why it matters

Law firms hold sensitive client data, and stolen Microsoft access tokens can give attackers access to the accounts behind them. Organizations that handle confidential material should treat social engineering requests as a real threat.

The checklist behind the tier

Checklist · 1 of 10 yes

No	Hits tech teams	Judgment: a social-engineering campaign against law firms' users, not a developer or IT-run product flaw.
No	Core infrastructure	Judgment: the compromise targets user tokens at law firms, not core infrastructure software itself.
No	Popular tool	Judgment: Microsoft users are phished for tokens; the platform itself is not flawed or breached.
Yes	Exploited in the wild	Darkreading: cybercriminals are re-targeting law firms with a social engineering con aimed at Microsoft tokens.
No	Public exploit	Darkreading describes a social engineering con; no published exploit code or PoC is mentioned.
No	Remote, no login	Darkreading: the attack relies on a social engineering con, so the victim must interact.
No	Full takeover	Darkreading: the con is aimed at stealing tokens; account takeover is not confirmed in the source.
No	Secrets exposed	Darkreading: the con is aimed at stealing access tokens; confirmed theft or exposure is not stated.
No	Supply chain	Darkreading reports no compromised package, update, build pipeline or signing key.
No	No fix yet	Darkreading describes a social engineering campaign, not an unpatched vulnerability.

Source

Extortion Group Luna Moth Flits Into Law Firms a Second Time ↗ darkreading · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided