According to a study by Cybereason, which sells endpoint protection software.
Alternatively, Cybereason are probably in a really good position to snarf passwords and then parallel construct an attack from a third party who gives a few major individual shareholders a kickback.
Does endpoint security even work?