[ekimekim]

What I'm confused by is how they got that far, to the point that 2FA was the only thing in their way. Did they already have this user's password?