Do you have off-site backups of all your critical data on a regular schedule?
Do you have physical 2FA on all your accounts?
Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch?
Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.
Don't use chrome to store your passwords. Use a password manager that's not tied to a cloud company that you can use multifactor Auth with, one of which is off device.
Don't leave yourself signed into your accounts. As soon as you're done sign out.
Keep everything portable and not centralised.
Convenience doesn't make for good cyber security.
You can't protect yourself from everything but you can make it more difficult.
Start at the fundamentals, dammit!
Do you have off-site backups of all your critical data on a regular schedule?
Do you have physical 2FA on all your accounts?
Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch?
Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.
Do you have suggestions on how to do off site backups? For example for images and documents
Don't use chrome to store your passwords. Use a password manager that's not tied to a cloud company that you can use multifactor Auth with, one of which is off device.
Don't leave yourself signed into your accounts. As soon as you're done sign out.
Keep everything portable and not centralised.
Convenience doesn't make for good cyber security.
You can't protect yourself from everything but you can make it more difficult.
I would be more careful towards social engineering than some random typical hackers. The former seems more prevalent and successful in my POV.