New research has uncovered a dangerous and unexpected threat to your credentials: avatars. Here’s what you need know.