{"id":12861,"date":"2025-06-29T14:27:21","date_gmt":"2025-06-29T08:57:21","guid":{"rendered":"https:\/\/threatcop.com\/blog\/?p=12861"},"modified":"2026-03-13T15:38:49","modified_gmt":"2026-03-13T10:08:49","slug":"luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands","status":"publish","type":"post","link":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/","title":{"rendered":"Luna Moth Phishing Scam: IT Support Turns into $800,000 in Ransom Demands"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">You have read the article about &#8220;latest phishing scams&#8221; and thought, \u201cThat won\u2019t happen to us.\u201d We\u2019ve got training, spam filters, and good old common sense. Well, guess what? A stealthy cybercrime group is banking on that exact mindset.<\/span><\/p><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 ez-toc-wrap-center counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #414141;color:#414141\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #414141;color:#414141\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#What_is_the_Luna_Moth_Attack\" >What is the Luna Moth Attack?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#Step-by-Step_Breakdown_of_the_Attack\" >Step-by-Step Breakdown of the Attack:<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#Whos_Being_Targeted\" >Who\u2019s Being Targeted?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#Why_Law_Firms\" >Why Law Firms?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#What_Made_This_Phishing_Effective\" >What Made This Phishing Effective?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#What_Can_Your_Enterprise_Do_Right_Now\" >What Can Your Enterprise Do Right Now?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#Final_Thought\" >Final Thought<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">According to<\/span><a href=\"https:\/\/thehackernews.com\/2025\/05\/hackers-are-calling-your-office-fbi.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\"> <span style=\"font-weight: 400;\">The Hacker News<\/span><\/a><span style=\"font-weight: 400;\">, the FBI just issued a warning that should make every law firm pay attention. A threat group called Luna Moth, also known as Silent Ransom Group, Chatty Spider, or UNC3753, has been quietly targeting U.S. law firms with a crafty, low-tech, high-impact campaign. Their goal is to gain remote access, steal sensitive data, and extort firms for ransom without ever dropping malware.<\/span><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_is_the_Luna_Moth_Attack\"><\/span><span style=\"color: #000000;\"><b>What is the Luna Moth Attack?<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">Since 2022, Luna Moth has been running <\/span><b>callback phishing campaigns<\/b><span style=\"font-weight: 400;\">, which are emails pretending to be from subscription services like antivirus tools or cloud apps. They claim you\u2019ve been charged, usually under $50, and prompt you to <\/span><i><span style=\"font-weight: 400;\">call a \u201csupport\u201d number to cancel.<\/span><\/i><\/span><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step-by-Step_Breakdown_of_the_Attack\"><\/span><span style=\"color: #000000;\"><b>Step-by-Step Breakdown of the Attack:<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span style=\"color: #000000;\"><b>Deliver Phishing Email: <\/b><span style=\"font-weight: 400;\">The victim receives a credible-looking email about an unknown subscription charge (often less than about $1,000). The email includes a PDF invoice.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Callback Trap: <\/b><span style=\"font-weight: 400;\">The email links directly to a phone number for the user to call if the victim refuses the charge. Now the trap is laid.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Identify as IT Support: <\/b><span style=\"font-weight: 400;\">When the victim calls, the attacker, posing as Customer Service\/IT, manipulates the victim into &#8220;joining&#8221; a remote access service like Zoho Assist.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Remote Access &amp; Data Theft<\/b><span style=\"font-weight: 400;\">: After accessing their files, the attacker can download files using a variety of tools like Rclone or WinSCP.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Demand Extortion Payment: <\/b><span style=\"font-weight: 400;\">Victims will receive an extortion email demanding monetary payment (as much as <strong>$800,000<\/strong>) and threatening to release data to the public.<\/span><\/span><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">But as of <\/span><b>March 2025<\/b><span style=\"font-weight: 400;\">, they\u2019ve upped their game. Now, they\u2019re <\/span><b>calling employees directly<\/b><span style=\"font-weight: 400;\"> and pretending to be from your company\u2019s IT team.<\/span><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">\u201cThey say it\u2019s routine maintenance,\u201d the FBI explains in its latest alert. \u201cThey guide employees into installing remote access software, and just like that, the breach begins.\u201d<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Whos_Being_Targeted\"><\/span><span style=\"color: #000000;\"><b>Who\u2019s Being Targeted?<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Mainly U.S. law firms. But it\u2019s spreading.<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"font-weight: 400; color: #000000;\">Legal and financial companies (especially those handling sensitive records)<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400; color: #000000;\">Individual employees who receive the <a href=\"https:\/\/threatcop.com\/blog\/what-to-do-if-you-receiving-phishing-emails\/\">phishing email<\/a> or get the call<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400; color: #000000;\">IT teams who aren\u2019t expecting an internal breach like this<\/span><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_Law_Firms\"><\/span><span style=\"color: #000000;\"><b>Why Law Firms?<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">According to a report by <\/span><b>EclecticIQ<\/b><span style=\"font-weight: 400;\">, Luna Moth shifted its focus to law firms because of the <\/span><b>type of data they hold<\/b><span style=\"font-weight: 400;\">: high-value IP, financial details, and confidential legal strategies. Law firms are under immense pressure to keep things discreet. That makes them more likely to pay up quickly.<\/span><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Once they got breached, it affected them in various ways.<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"color: #000000;\"><b>Sensitive data gone<\/b><span style=\"font-weight: 400;\">: Legal documents, financial records, internal IP\u2014all swiped<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Massive financial exposure<\/b><span style=\"font-weight: 400;\">: We\u2019re talking ransom demands of up to $800,000.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Employee stress<\/b><span style=\"font-weight: 400;\">: Imagine being the one who picked up that call.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Reputation damage<\/b><span style=\"font-weight: 400;\">: Clients don\u2019t exactly love it when their info is caught in a breach.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Compliance nightmares<\/b><span style=\"font-weight: 400;\">: Data regulations don\u2019t take kindly to leaks, even accidental ones.<\/span><\/span><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Made_This_Phishing_Effective\"><\/span><span style=\"color: #000000;\"><b>What Made This Phishing Effective?<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Honestly? Because it all feels real. Most teams are not trained for that specific type of trick.<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"font-weight: 400; color: #000000;\">These emails look totally innocuous. No links. No attachments.<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400; color: #000000;\">These phone calls for support sound just like the &#8216;real deal.&#8217;<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400; color: #000000;\">The tools that are being asked to be installed are exactly what your IT team is likely using already anyway.<\/span><\/li>\n\n\n\n<li><span style=\"font-weight: 400; color: #000000;\">People panic as soon as you mention money; even $50 is enough to act.<\/span><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">This isn\u2019t some flaw in your firewall. It\u2019s just people being people. If someone called your team right now and said, \u201cWe\u2019re from IT. There\u2019s an urgent issue with your account. Would your employees know what to do?<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Can_Your_Enterprise_Do_Right_Now\"><\/span><span style=\"color: #000000;\"><b>What Can Your Enterprise Do Right Now?<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Let\u2019s keep this simple. Here\u2019s what you can do today:<\/span><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span style=\"color: #000000;\"><b>Train Your Employees: <\/b><span style=\"font-weight: 400;\">Make sure your team knows what callback phishing sounds like. Role-play it. Quiz them. Repeat.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Create a \u201cHow We Contact You\u201d Policy:<\/b><span style=\"font-weight: 400;\"> Set up a clear protocol for how your IT team reaches out. \u201cWe\u2019ll never ask you to install software over the phone\u201d should be the default.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Disable Unnecessary Admin Rights:<\/b><span style=\"font-weight: 400;\"> If a device doesn\u2019t need admin rights, don\u2019t give them. This reduces what attackers can do once inside.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Watch for Remote Tool Downloads:<\/b><span style=\"font-weight: 400;\"> Flag any installs of WinSCP, Rclone, or new RMM tools that aren\u2019t pre-approved.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Back Up Like It\u2019s Your Job:<\/b><span style=\"font-weight: 400;\"> Maintain encrypted, offline backups of your most sensitive data. Test your restore process.<\/span><\/span><\/li>\n\n\n\n<li><span style=\"color: #000000;\"><b>Turn on MFA Everywhere:<\/b><span style=\"font-weight: 400;\"> And not just for logins. Use it for file access, internal apps, and VPNs.<\/span><\/span><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Final_Thought\"><\/span><span style=\"color: #000000;\"><b>Final Thought<\/b><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Luna Moth doesn\u2019t use malware. They use people. Luna Moth is a wake-up call. Not just for law firms, but for any organization where trust can be exploited. Let\u2019s stop treating cybersecurity like it\u2019s only about tech. It\u2019s also about people, how they think, how they react, and what they trust. And trust us, the attackers know that.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>You have read the article about &#8220;latest phishing scams&#8221; and thought, \u201cThat won\u2019t happen to us.\u201d We\u2019ve got training, spam filters, and good old common sense. Well, guess what? A stealthy cybercrime group is banking on that exact mindset. According to The Hacker News, the FBI just issued a warning that should make every law [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":12862,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[406],"class_list":["post-12861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-attacks","tag-luna-moth-phishing-scam-it-support-turns-into-800"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Luna Moth Scam: Fake IT Support Leads to $800K Ransom<\/title>\n<meta name=\"description\" content=\"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Luna Moth Scam: Fake IT Support Leads to $800K Ransom\" \/>\n<meta property=\"og:description\" content=\"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/\" \/>\n<meta property=\"og:site_name\" content=\"Threatcop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-29T08:57:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-13T10:08:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Threatcop\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatcop\" \/>\n<meta name=\"twitter:site\" content=\"@threatcop\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Threatcop\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/\"},\"author\":{\"name\":\"Threatcop\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/e4db27ffd37219d73fc6b40cc9d45cfa\"},\"headline\":\"Luna Moth Phishing Scam: IT Support Turns into $800,000 in Ransom Demands\",\"datePublished\":\"2025-06-29T08:57:21+00:00\",\"dateModified\":\"2026-03-13T10:08:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/\"},\"wordCount\":851,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/unnamed-19.jpg\",\"keywords\":[\"Luna Moth Phishing Scam: IT Support Turns into $800\"],\"articleSection\":[\"Cyber Attacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/\",\"name\":\"Luna Moth Scam: Fake IT Support Leads to $800K Ransom\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/unnamed-19.jpg\",\"datePublished\":\"2025-06-29T08:57:21+00:00\",\"dateModified\":\"2026-03-13T10:08:49+00:00\",\"description\":\"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#primaryimage\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/unnamed-19.jpg\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/unnamed-19.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Luna Moth Phishing Scam\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Luna Moth Phishing Scam: IT Support Turns into $800,000 in Ransom Demands\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"name\":\"Threatcop\",\"description\":\"Cybersecurity Blogs, News, Updates, and Articles\",\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\",\"name\":\"Threatcop\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/threatcop-logo-black-1.png\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/threatcop-logo-black-1.png\",\"width\":432,\"height\":102,\"caption\":\"Threatcop\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/people\\\/Threatcop\\\/100083109892339\\\/\",\"https:\\\/\\\/x.com\\\/threatcop\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/threatcop\\\/\",\"https:\\\/\\\/www.instagram.com\\\/threatcop_official\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/e4db27ffd37219d73fc6b40cc9d45cfa\",\"name\":\"Threatcop\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"caption\":\"Threatcop\"},\"sameAs\":[\"https:\\\/\\\/threatcop.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Luna Moth Scam: Fake IT Support Leads to $800K Ransom","description":"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/","og_locale":"en_US","og_type":"article","og_title":"Luna Moth Scam: Fake IT Support Leads to $800K Ransom","og_description":"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.","og_url":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/","og_site_name":"Threatcop","article_publisher":"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","article_published_time":"2025-06-29T08:57:21+00:00","article_modified_time":"2026-03-13T10:08:49+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg","type":"image\/jpeg"}],"author":"Threatcop","twitter_card":"summary_large_image","twitter_creator":"@threatcop","twitter_site":"@threatcop","twitter_misc":{"Written by":"Threatcop","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#article","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/"},"author":{"name":"Threatcop","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/e4db27ffd37219d73fc6b40cc9d45cfa"},"headline":"Luna Moth Phishing Scam: IT Support Turns into $800,000 in Ransom Demands","datePublished":"2025-06-29T08:57:21+00:00","dateModified":"2026-03-13T10:08:49+00:00","mainEntityOfPage":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/"},"wordCount":851,"commentCount":0,"publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"image":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg","keywords":["Luna Moth Phishing Scam: IT Support Turns into $800"],"articleSection":["Cyber Attacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/","url":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/","name":"Luna Moth Scam: Fake IT Support Leads to $800K Ransom","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#primaryimage"},"image":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg","datePublished":"2025-06-29T08:57:21+00:00","dateModified":"2026-03-13T10:08:49+00:00","description":"Hackers posing as IT support use Luna Moth phishing campaigns to steal company data and demand up to $800,000 in ransom from targeted organizations.","breadcrumb":{"@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#primaryimage","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2025\/07\/unnamed-19.jpg","width":1280,"height":720,"caption":"Luna Moth Phishing Scam"},{"@type":"BreadcrumbList","@id":"https:\/\/threatcop.com\/blog\/luna-moth-phishing-scam-it-support-turns-into-800000-in-ransom-demands\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/threatcop.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Luna Moth Phishing Scam: IT Support Turns into $800,000 in Ransom Demands"}]},{"@type":"WebSite","@id":"https:\/\/threatcop.com\/blog\/#website","url":"https:\/\/threatcop.com\/blog\/","name":"Threatcop","description":"Cybersecurity Blogs, News, Updates, and Articles","publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/threatcop.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/threatcop.com\/blog\/#organization","name":"Threatcop","url":"https:\/\/threatcop.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/06\/threatcop-logo-black-1.png","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/06\/threatcop-logo-black-1.png","width":432,"height":102,"caption":"Threatcop"},"image":{"@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","https:\/\/x.com\/threatcop","https:\/\/www.linkedin.com\/company\/threatcop\/","https:\/\/www.instagram.com\/threatcop_official\/"]},{"@type":"Person","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/e4db27ffd37219d73fc6b40cc9d45cfa","name":"Threatcop","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","caption":"Threatcop"},"sameAs":["https:\/\/threatcop.com"]}]}},"_links":{"self":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/12861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/comments?post=12861"}],"version-history":[{"count":2,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/12861\/revisions"}],"predecessor-version":[{"id":12871,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/12861\/revisions\/12871"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media\/12862"}],"wp:attachment":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media?parent=12861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/categories?post=12861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/tags?post=12861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}