I just had some phone calls with customers and it seems like there is a new way for stealing passwords / creditcard numbers.
The thiefs make pages with supposed stolen passwords or creditcard numbers so you can check if your password or creditcard number has already been stolen. Because the list is very long, the people us Ctrl+F to open the search tab and search for their password/creditcard number. The problem is: After hitting Ctrl+F you do not open the search tab from your browser, you open a mask that looks exactly the same, but it does not search the list for your password, it sends the input you just made to the thiefs.
It seems like this is programmed with javascript and i found a blog that made a example page with the fake serach tab:
Link (scroll to bottem for example).
Take care. Do not loose your password, creaditcard number or worse: your COH2 key this way.