Phishing with man-in-the-middle http server allowing to capture credentials, bypass 2-factor authentication is simply a common practice, but attackers started to cooperate erstwhile they find a victim. They share captured session cookie, divided the tasks on victim user account and execute all activities in very effective and timely manner. Sharing session cookies besides bring fresh challenges for incidental investigators.
Website: https://confidence-conference.org
Facebook: https://www.facebook.com/confidence.conference
Twitter: https://twitter.com/confidenceconf