Mandiant analyzed ShinyHunters' MO, detailing how it steals login and MFA codes.