I haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend month

I haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend months infiltrating organizations, and adding 2fa to what is already a custom spear phishing page is not that much of a hurdle.