Low to mid-tier support agents are being targeted directly. Sometimes they get phished (yes people will give you MFA codes and authorize push notifications if asked), sometimes they get social engineered, and sometimes they just solicit and pay them. Not just speaking of LAPSUS$ here.