It also looks like they've used leaked old credentials that weren't updated in years: https://x.com/i/status/2068635848786972863