How Google Authenticator gave attackers one company’s keys to the kingdom

Google's app for generating MFA codes syncs to user accounts by default. Who knew?