[oh_sigh]

Bribe a guard, install a hardware keylogger on random workstation, steal corporate login password, and go from there.

[tony101]

And grab any U2F security keys in sight.

[oh_sigh]

A missing U2F key might trigger an audit which could lead to discovery of the keylogger. Better bet would be to get the passwords, and then come back and register a second U2F key to the victims account.