It didn't sound to me like the attackers were getting past 2FA, but rather that they were setting up new accounts with the same profile picture. That wouldn't r

It didn't sound to me like the attackers were getting past 2FA, but rather that they were setting up new accounts with the same profile picture. That wouldn't require an attack or compromise at all. Maybe I'm reading it wrong though.