How an account actually gets stolen

In most everyday situations an attacker does not need to break into your iPhone. They only need your credentials. Three typical scenarios.

Case 1 — You reuse the same password

You have:

Instagram : myaddress@email.com + Toto123!
OtherSite : myaddress@email.com + Toto123!

The second site suffers a data breach. The attacker gets:

myaddress@email.com
Toto123!

They then automatically try those credentials on Instagram, Facebook, Amazon and others. This is known as credential stuffing.

Case 2 — A fake Instagram message

"Your Instagram account is about to be suspended. Click here to verify your identity."

The site looks like Instagram. You type your password. You have just handed it to the attacker.

Case 3 — The attacker takes your email address

This one is especially serious. Many services allow:

Forgot password
        ↓
Link sent by email
        ↓
Create a new password

Cybermalveillance.gouv.fr therefore points out that your mailbox password is one of the most important passwords to protect.