Cybercriminals typically use the following techniques rather than a single "tool" to gain unauthorized access:
This is the single best defense. Even if someone has your password, they cannot log in without a code from your phone or an authenticator app.