Credential Stuffing:

This type of attack involves using stolen credentials (username and password combinations) obtained from other data breaches to access other accounts. 2FA makes this much harder because attackers would also need access to the user's second factor, like a code from an authenticator app or a mobile device, which is unlikely to be stolen simultaneously with the username and password.

Phishing:

Phishing attacks involve deceptive emails or websites designed to trick users into revealing their credentials. Even if a user is tricked into entering their username and password on a fake site, 2FA prevents them from logging in without the second factor. This adds a significant barrier to unauthorized access.