As I read it, the 2FA login does some processing of the credentials before submitting it to their authorization server. Someone logging into a machine directly instead of going through their portal would have to do this processing themselves. They found a program designed to do just this on the compromised machine, which a normal user would be very unlikely to have, and thus serves as strong evidence of malicious activity.