How stolen credentials and cookies can bypass MFA protections.