Luna Moth, also tracked as Silent Ransom Group, is returning to law firms it extorted earlier this year. This time a caller talks staff through copying a Microsoft Graph access token out of Microsoft 365 Copilot during a video call, and no malware is involved anywhere in the chain.

What happened

ReliaQuest documented the campaign on 12 November. A blank-subject email from a free webmail address carries a deliberately broken PDF that crashes any viewer. The caller then phones the target, often on a personal number outside corporate call controls, posing as IT support responding to a malicious email, and offers to fix it on a video call.

On the call the fake technician has the user open Copilot in the browser on their managed laptop, open developer tools, find the request Copilot sends to Microsoft Graph and copy the access token it carries, then paste that token into a public text-sharing site. Within a minute the attacker replays the token from their own server and pulls thousands of files through the Graph API.

The token was issued to a compliant device after a normal sign-in, so it satisfies MFA and Conditional Access, which check at issue time and not on every use. Default token lifetime is 60 to 90 minutes without Continuous Access Evaluation. The group went back to firms first extorted in May and August that appear on its leak site.

Who is affected

• Microsoft 365 tenants where Copilot or other Graph-connected apps are signed in on user devices.
• Professional services firms holding client confidential data; legal is the current focus and accounting or advisory work is the obvious next target.
• Any organisation whose staff can be phoned directly, which is most SMEs, because the call never touches corporate telephony.

What to do now

Enable Continuous Access Evaluation with location enforcement, then brief staff that no IT person will ever ask them to open developer tools or paste a token anywhere.

• Turn on CAE in Conditional Access so an issued token stops working when the session's location changes.
• Block developer tools and paste sites on managed browsers where policy allows, and alert on bulk Graph downloads; one intrusion used the SharePointScavenger/1.0 user agent.
• Correlate a blank-subject external email, an inbound video call and Graph access from an unfamiliar address. That combination is the detection.
• Give users one rule: verify any unsolicited IT call by phoning the help desk number they already know.

What this means for South African businesses

MFA no longer ends the conversation when the employee authenticates properly and hands over the result. A South African SME running Copilot or any Graph app on staff laptops is exposed to exactly this play, and the extortion email arrives with no malware alert behind it. My read is that copycat groups will adopt this quickly, because it needs a phone, a script and an hour rather than an exploit kit, so a firm already named on a leak site should treat a second approach as likely.

Source: ReliaQuest Threat Research.

Also on the blog

• Windows SignDrop zero-day: SYSTEM from a standard user, no patch yet
• Check Point CVE-2026-123039: gateways rooted, TSGA backdoor, ESXi wiper

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.