Extortion Group Luna Moth Targets Law Firms With Microsoft Token Theft

# Extortion Group Luna Moth Targets Law Firms With Microsoft Token Theft

https://gcdradar.vercel.app/incidents/extortion-group-luna-moth-targets-law-firms-with-microsoft-t · AIR-2026-1938 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world extortion campaign against named victims.
- Fix status: No fix needed
- First reported: 2026-11-12
- AI role: No AI role

## Summary

The Luna Moth extortion group launched a renewed campaign targeting law firms that refused previous ransom demands. Attackers used social engineering tactics specifically designed to steal Microsoft access tokens.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-12: Extortion Group Luna Moth Flits Into Law Firms a Second Time (https://darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time)

## Sources

- 2026-11-12 Dark Reading: Extortion Group Luna Moth Flits Into Law Firms a Second Time https://darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.