Why an account can be hacked for no apparent reason

This is a case I've seen that might help some people here.

The context is a person who has had all their accounts hacked, including Steam, and their balance stolen. He changed passwords, added two-step verifications to the phone and all the existing security measures and they always continued to log into all their accounts on various platforms.

I told him to run an antivirus on both the mobile phone and the PC (a Malwarebytes analysis). Everything was clean.

For a while the hacker was quiet without disturbing us, but he returned months later. That person changed the passwords again and they continued logging in.

He again performed an analysis with Malwarebytes and the mobile phone was still clean, but several Trojans and a Lumma jumped onto the PC (on investigation we saw that it was a virus that steals login credentials). So I told him to quarantine all the viruses and also change the password for each account again.

I don't know if it worked because it was recent, so far nothing strange has happened again. But perhaps for people who have been logged into the account and don't know how this information could help them.

I would also like to know why the virus did not appear from the first time and the antivirus only recognized it the second time.