From password reset to data exfiltration