The two most common attack campaigns are drive-by malware infections done through phishing links and infections via compromised documents. Neither of which involve credentials.

Attacks involving credential stealing almost never involve malware.

Source: The 2020 Microsoft Digital Defense Report https://www.microsoft.com/en-us/security/business/security-i...

Only about half. The rest is through emailed trojans and RCE bugs.