Simple, real-world techniques include shoulder surfing with attackers observing potential victims when they type their passwords. 2. Attackers also manipulate the “human weakness” of their victims via social engineering. A professionally-crafted online form or an email (phishing attack) apparently from a trustworthy sender can persuade even well-trained users to divulge their passwords. 3. Cybercriminals with foothold in organization’s network can use malware to search fordocuments containing passwords or log password keystrokes and send this information to their C&C server. Black hats can also extract encrypted password files and crack them offline. 4. More demanding attack techniques include intercepting the network traffic of employee devices that are used remotely or in a public place. 5. One of the most popular ways to break password protection is to brute force them. Automated scripts try millions of password combinations over a short period of time until the correct one is found. This is why it has become necessary for passwords to become longer over the years. The more complex the password is, the more time cybercriminals need to guess it.