GMO Internet found malicious programs on Onamae.com Desktop Cloud, a Windows VPS traders use to run MT4/MT5 bots 24/7, and shut down all 26,739 servers. Broker logins saved in the trading tools may have been taken, and brokers including OANDA Japan report unauthorized logins.
Software that logs in by itself can't use MFA. A small case of the non-human identity problem.
https://japancyberwatch.com/articles/gmo-onamae-desktop-cloud-fx-vps-breach-2026