Apparently ads are now scraping usernames and passwords that are autofilled thanks to password managers.
https://www.theverge.com/2017/12/30/16829804/browser-password-manager-adthink-princeton-research
(Use a password manger, but be sure auto-fill is off.)