There are many phishing sites which steal away your creds. Take for example Jelurida, they had a online wallet. Hackers made phishing website out of it and stole many coins. Jelurida stopped their online wallets and have a client now.
Good point.
Always download wallet from official websites only. Newbies don't know all this stuff and login their private key anywhere, hence as a word of caution, Never give your private keys anywhere or to anyone no matter whomsoever they are.
Always worth repeating for newbies' sake, that's true!