Anything is possible, it's just a matter of the level of effort you're willing to put in.
Depending on the individual you're targeting... phishing, key loggers, social engineering, etc.. are all possible methods.
You'll still likely need to solve for two factor auth issues as well, but it's...