Many users think 2FA is a silver bullet. T2Bot evades it by using a man-in-the-browser (MitB) attack. It intercepts the SMS or authenticator app code as you type it and forwards it to the attacker in real-time, allowing them to complete the login session before you realize what happened.