For all the sophistication of these attacks, both victims made absolutely elementary mistakes.

One saved a photo of his plaintext seedphrase to the cloud, the other was convinced to type in his seedphrase on a website.

Still absolutely required reading, I think: