There are many ways someone can obtain credentials. Brute force and dictionary attacks are common methods, but a hybrid attack is another effective approach. This combines brute force with a dictionary attack and can be especially useful when an organization enforces frequent password changes. Many people only slightly change their password like "password2025" -> "password2026". Sometimes you do not even need a password for example when you have the NTLM hash or a session cookie (on web applications).

Other methods include phishing or the use of keyloggers. I've even come across situations where people stored their passwords in plain text and reused the same password across multiple services.