The other 10% is just literally asking for their password
More precisely, it's a Burp Suite plugin that tests for that combo, and users have no idea because it's one of a million didn't things they also have no idea are running.
this is even too advanced. 99% of modern hacking is :