“An Armadin agent identified 438 exposed credentials on the dark web for a target, successfully used seven to log in, and exploited an incomplete two-factor authentication registration process to gain access.”