Intercept SMS codes or extract temporary tokens from apps like Google Authenticator .
(for devices you own, with consent), consider:
analyzing SpyNote for defense: