[snarf21]

Things like this: https://security.stackexchange.com/questions/157756/mitm-att...

This is assuming an owned machine. Not the easiest attack but still possible. Obviously things like Google Authenticator (while good) are even more susceptible to MITM phishing.

[scrollaway]

If the machine is owned it's trivial to dig the cookie jar once you're logged in.