[mcraiha]

Did they bypass/disable 2FA or did they get the code somehow?

[suitcase]

They probably stole the cookie from an active session via malware