The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

MFA verifies who logged in. It has no idea what they do next.

Get your passwords out of Bitwarden while you still can

America's top cyber-defense agency left a GitHub repo open with passwords, keys, tokens – and incredibly obvious filenames