What Happened
We are starting our conversation now. Darkreading reports that the extortion group Luna Moth is targeting law firms a second time, with Microsoft 365 access token theft at the center of the campaign. The group is going back after firms that refused to pay its first ransom demand. The method is a social engineering con aimed at stealing Microsoft access tokens.
For an MSP, that matters for a simple reason. A firm that already said no once is being approached again, and the second attempt does not need a new software flaw. As reported, the activity is aimed at people and at the sessions their Microsoft 365 accounts carry. If a token is taken, the attacker is not breaking in. They are signing in.
Timeline
They have their own reasons for wanting to keep this quiet. The sources give no dates for the first campaign or for any individual approach in the second one.
- We are starting our conversation now. Darkreading reports that the extortion group Luna Moth is targeting law firms a second time, with Microsoft 365 access token theft at the center of the campaign. The group is going back after firms that refused to pay its first ransom demand. The method is a social engineering con aimed at stealing Microsoft access tokens.
- For an MSP, that matters for a simple reason. A firm that already said no once is being approached again, and the second attempt does not need a new software flaw. As reported, the activity is aimed at people and at the sessions their Microsoft 365 accounts carry. If a token is taken, the attacker is not breaking in. They are signing in.
Who Is Affected
We are starting our conversation now. Law firms. The reporting points at firms that refused to pay the group's first ransom demand, which Darkreading describes as re-targeting the same victims.
For MSPs, the practical question is your client list. If you serve legal clients, or any professional services client whose mail holds privileged material, the same approach applies. The group does not need to succeed everywhere, because a single successful con is enough to hand it a working session.
Technical Details
We are starting our conversation now. Product: Microsoft access tokens, the credentials that keep a Microsoft 365 session authenticated.
Attack vector: a social engineering con aimed at stealing those tokens, as Darkreading describes it.
CVE: none listed in the sources. No affected versions are named, and the sources do not describe a software vulnerability or a patch for this activity.
Why Microsoft 365 Access Token Theft Is Hard To Clean Up
In general, an access token is proof that a sign-in already succeeded. When an attacker holds a valid token, the session looks legitimate to the tools that watch for bad passwords and failed logins, so the usual alarms may not fire.
As a standing practice, treat confirmed token theft as an active session takeover rather than a password problem. Revoke the sessions, reset the credentials, then look at what the account did while the attacker held it, including mail rules, forwarding and file shares. In general, the sooner that work starts, the less the attacker keeps.
What MSPs Should Do
We are starting our conversation now. No patch closes a con. These steps are standard hardening and response practice for social engineering and token theft, not a list of things the sources say these firms did or missed.
- We are starting our conversation now. Move the accounts that matter to phishing-resistant MFA such as passkeys or security keys, starting with Microsoft 365 administrators and anyone who touches client files or payments.
- We are starting our conversation now. Review Conditional Access with token theft in mind: block legacy authentication, require managed or compliant devices for mail and file access, and set session lifetimes you can defend.
- We are starting our conversation now. Watch sign-in and audit logs for session anomalies, including new devices, new locations, new mail rules, new forwarding addresses and new application consents. A stolen token shows up as a successful sign-in, so a green tick is not proof of safety.
- We are starting our conversation now. Give clients one plain rule and repeat it: never approve a prompt you did not start, and never hand a code or a password to someone who called you.
- We are starting our conversation now. Write the response down before you need it: who revokes sessions, who resets credentials, who checks mailbox rules, and who talks to the client.
- We are starting our conversation now. For any suspected account, revoke refresh tokens, reset the credentials, and review the activity that happened during the live session.
- We are starting our conversation now. Check that the Microsoft 365 data you would need to restore is backed up somewhere the attacker cannot reach, and that a restore has been tested.
- We are starting our conversation now. Brief law firm clients that they may be approached again, especially the ones who refused to pay before.
How EnterProtect Helps
We are starting our conversation now. EnterProtect backup keeps clean, restorable copies of the data your clients depend on, including Microsoft 365 workloads, so a bad day does not have to become an unrecoverable one.
We are starting our conversation now. EnterProtect recovery is the path back to a working environment: restored mail, restored files, a client who can open their matter files again.
We are starting our conversation now. EnterProtect vulnerability scanning keeps a current view of exposed versions in the environments you manage, so patching stays a scheduled task rather than a surprise.
We are starting our conversation now. None of that stops a con. What it changes is what the hours after one look like.
Frequently Asked Questions
What Is Luna Moth?
Luna Moth is an extortion group. Darkreading reports that it is targeting law firms a second time and going back after firms that refused to pay its first ransom. The reported method is a social engineering con aimed at stealing Microsoft access tokens.
What Is a Microsoft Access Token and Why Would Someone Steal One?
An access token is the credential that shows a Microsoft 365 session is already authenticated, so the user is not asked to log in again. Someone holding a valid token can work inside the account without a fresh password prompt. In general, that is why token theft is more useful to an attacker than guessing a password.
How Does the Con Work?
Darkreading describes it as a social engineering con aimed at stealing Microsoft access tokens and does not publish the specific pretexts used. As a general pattern, these approaches ask a person to do something helpful, such as approving a prompt they did not start or passing on a code. The target is the session, not the password.
If a Token Is Stolen, Does a Password Change Fix It?
Not by itself, in general. A live token can keep a session open after a password change, so the usual response is to revoke the account sessions and refresh tokens, reset the credentials, and then review what the account did. Check mailbox rules, forwarding addresses and file sharing, because those survive a password change if nobody looks.
Is There a CVE or a Patch for This?
No. The sources name no CVE and no affected software versions for this activity, because it is reported as a social engineering con rather than a software vulnerability. Patching on its own will not close it, though keeping versions current remains standard practice.
What Should MSPs Tell Law Firm Clients Right Now?
Tell them an extortion group is approaching firms that refused to pay before, and that the approach targets Microsoft 365 sessions rather than a specific piece of software. Give staff one rule for authentication prompts and inbound calls. Then make sure the accounts holding client matter files have the strongest sign-in protection you can deploy.
Sources
- Extortion Group Luna Moth Flits Into Law Firms a Second Time (Darkreading)