18-year-old Lapsus$-affiliated attacker purchased stolen contractor VPN credentials from dark web. Bypassed Duo MFA by bombing target with push notifications for >1 hour then impersonating Uber IT support via WhatsApp to get approval. Discovered plaintext Thycotic PAM admin credentials in a PowerShell script post-VPN. Accessed G-Suite, Slack, HackerOne reports, financial invoicing tool. No customer data confirmed stolen. Attacker publicly posted in Uber’s Slack.