The standard advice for years has been that multi-factor authentication is the best single thing you can do to protect your accounts, and that's still worth following. However, the attacks we're dealing with week to week have stopped trying to beat it, and started going around it. So what are they actually after?