> The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker.

This is why we need webauthn everywhere! Push notifications and friends are all susceptible to this kind of attack, webauthn is not.