An HR pretext works everywhere. Employees are conditioned not to question it, because the topics are personal and the consequences are employment-related.
Once the seeds live in an account protected by the same identity, there is one factor wearing two names.
Three Cloudflare employees typed their password into the attacker’s page. Nothing happened.