Facebook uses two-step authentication or "login approval", which means that all unrecognized devices will have to enter a code received through SMS. Suppose my Samsung device is the only device that has been logged in to my Facebook account. What must the attacker do so that:
- I won't receive any SMS (or at least won't see any)
- I don't receive any e-mail about that
- The attacker gains access to my account and can view messages/be active (liking, commenting)
What is the most realistic and possible scenario?