INSTAGRAM — SHARED ACCOUNT @UNI_ESPORTS_SOC
Thursday, login activity

19:20  Login OK       known device        (routine post)
23:37  Login ATTEMPT  unknown device
       └ password ACCEPTED
       └ 2FA code sent by SMS to registered number
23:40  Login OK       unknown device
       └ 2FA code entered correctly, 1st attempt
23:47  Post published: "NordVPN Giveaway"
       └ links to nord-vpn-promos[.]net/login
23:58  Account password CHANGED from unknown device

NOTE: password was correct at 23:37. Only the 2FA
code stood between the attacker and the account.