The article makes it sounds like the perpetrators used some high tech hacking to do this. In effect they probably just used some kind of normal screen sharing like msteams did the exam for the client and pressed ok.