The vast majority of hacking is just credentials. There are four basic ways to get creds:
STAB
Steal: using malware, etc.
Try: brute force, guessing, etc.
Ask: social engineering, etc.
Buy: infostealer logs, etc.
Steal. Try. Ask. Buy.
A collab with @UK_Daniel_Card