[haloux]

You’re right that passwords aren’t BFd often and that phishing is by far the easiest way.

Regarding other methods: passwords are however, guessed, or stolen. If a hacker can grab the app databases store of passwords, they can preform offline cracking and quickly start getting into accounts that have matching hashes to commonly used passwords. All it takes is a few accounts and you can usually pivot around from there to get some more privileged access.