At this point, I'm convinced that 90% of modern hacking is reliant on
username: admin
password: password
The other 10% is just literally asking for their password
More precisely, it's a Burp Suite plugin that tests for that combo, and users have no idea because it's one of a million didn't things they also have no idea are running.
this is even too advanced. 99% of modern hacking is :