This attack was enabled by the normalization of orgs' aggressive 2FA postures.