The malware will just take the session cookie. Some actions still require 2FA approval, but it’s not many, iirc.