The risk is "materially understated", researchers are saying as passwords and critical data can be exfiltrated.