How do hackers get past two factor authentication?

Yesterday I had like 7 attempts from all different countries trying to get into my account and I kind of laughed it off because I thought it was near impossible for them to get in without access to my phone. But of course this morning my friend sends me a screenshot of my profile with my profile picture and cover photo changed and name changed to meta copyright infringement. Appeal was denied and now I’m going through every single last process. But how do they get past two factor?