The defendants used credential stuffing techniques to compromise accounts, sell access to them, and devised a method for buyers to withdraw funds, resulting in millions of dollars in illicit gains.