If I had to guess, likely textbook spear phishing. If they were able to get past 2FA, then either it was weak 2FA or they stole auth tokens, not passwords. In g

If I had to guess, likely textbook spear phishing. If they were able to get past 2FA, then either it was weak 2FA or they stole auth tokens, not passwords. In general that approach is unreasonably effective - at least single-digit percentage points of effectiveness. Between that and just bribing support people (or they were in on it to begin with), you have the two of the most common attacks on user/customer data.