Luna Moth returns to law firms that likely did not pay, with a token handoff: a video-call 'IT support' agent has the employee copy a Microsoft Graph access token out of Microsoft 365 Copilot through browser developer tools, then bulk-downloads files from the attacker's own server (ReliaQuest)
ReliaQuest: Luna Moth has staff hand over a Graph token from Copilot on a video call; no sign-in event follows
Analysis
ReliaQuest says Luna Moth, also called Silent Ransom Group, has targeted law firms since at least mid-2023 and in October and early November went back to firms it had extorted in May and August; those firms appear on the group's leak site, which ReliaQuest says suggests they likely did not pay, and the group exfiltrated a second round of data (ReliaQuest, 2026-11-12). The approach reverses the group's earlier flow: a blank-subject email from a free address carries a deliberately invalid PDF that crashes the viewer, and the attacker then calls the target, often on a personal number outside corporate call controls, posing as IT support responding to a "malicious email" (ReliaQuest, 2026-11-12). By late August the group paired video calls with a built-in remote-assistance tool, and by October the video call alone carried both the conversation and the screen control (ReliaQuest, 2026-11-12).
On the call the attacker has the employee open Microsoft 365 Copilot in the browser on a managed, compliant laptop, open the browser's developer tools to find the request Copilot sends to Microsoft Graph and copy the access token it carries, and paste the token into a public text-sharing site where the attacker retrieves it (ReliaQuest, 2026-11-12). Within a minute the attacker replays the token from its own server and downloads files en masse through the Graph API, thousands in about an hour (ReliaQuest, 2026-11-12). The stolen token passes Conditional Access because the device check runs only at sign-in, not when the token is later used, and, unlike device-code phishing, the token is issued to the victim's compliant device and then handed over (ReliaQuest, 2026-11-12). Nothing is installed, and the video-call applications are signed legitimate software (ReliaQuest, 2026-11-12).
Cited evidence
This token-based exfiltration is almost certainly a new tactic for the group.
Attackers never have to authenticate, so no sign-in events are generated for their address.
In the observed intrusions, the first download from attacker infrastructure came about a minute after the token was copied.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.