Certain users are reporting their accounts are being used to send unauthorized emails and conduct suspicious activities. After further investigation, a security analyst notices the following: All users share workstations throughout the day Endpoint protection was disabled on several workstations throughout the network Travel times on logins from the affected accounts are impossible Sensitive data is being uploaded to external sites All user account passwords were forced to be reset and the issue continued Which of the following attacks is being used to compromise the user accounts?