A mix of the two, but my impression is it leans more towards the latter mixed with data gleaned from viruses and malware. That is how most WoW accounts get taken these days, a script that installs itself silently through the browser and sends your logins back home. They've even gotten them sent out hidden in ads and…