Yahoo warning users that hackers forged cookies to access accounts (zdnet.com)

If I understood this correctly, two factor authentication was irrelevant.

Whoever did this just forged the cookies and had full webmail access regardless of any authentication method.