How exactly did they get around the 2FA? I'm guessing the app he installed stole his password when he entered it, but he does say that he had 2FA enabled. How d

How exactly did they get around the 2FA? I'm guessing the app he installed stole his password when he entered it, but he does say that he had 2FA enabled. How did they get around this and log in to his account? Or did the app somehow siphon off the 2FA code also?