The method of successfully phishing a user, installing a malware, and remotely
controlling the infected computer without anyone noticing did not have a very
high success rate. In addition finding the data to steal required time, and the
longer an attacker remained in a network, it increased their chances of being
caught.
As a result, attackers began to shift their focus to exploiting web application
security vulnerabilities, These attacks are significantly mare efficient and effective
Every time a user visits a website and enters their credentials, signs up for an
account, opens a record of some sort, makes a purchase, etc., all of that
information including personal data is stored on a server that sits behind that
application. Taking over a website or app by exploiting a software vulnerability
often gives attackers free access to the data that is stared an that server.