Comment by ekimekim

What I'm confused by is how they got that far, to the point that 2FA was the only thing in their way. Did they already have this user's password?