The malware will just take the session cookie. Some actions still require 2FA approval, but it’s not many, iirc.

So the malware can delete all your projects or inject malware into them, but thankfully it won't be able to log in again later?