I now have a much stronger password and will stay away from infected sites.
Password strength is good practice but not a panacea. Unless you're a high-mucketymuck somewhere, bad actors aren't likely to be targeting you specifically, and even if they are, they're unlikely to be trying to hack you by brute-force guessing your password, which is really the only thing that a "strong password" protects against.
There are far more likely ways your password will get stolen, and for all of these ways, the strength of your password is irrelevant. Some examples:
1)
Large website hacks: Bad actors manage to infiltrate some large organization's user access database and extract login credentials. Not only do these credentials allow access to user accounts at this org's website, but
many people reuse the same login credentials at multiple sites, creating a cascading effect. So many sites have had this happen that almost every user who's been active online for more than a few years has been caught up in one of these hacks. You can check to see by entering your email address at
https://haveibeenpwned.com/. The best defense here is to always use unique passwords for all your different accounts. The only practical way to do this is with a password manager, but those are high-value targets for bad actors, and there have been incidents and vulnerabilities associated with them, too.
2)
Social engineering: Some smooth-talker gets you on the phone manages to convince you of their trustworthiness and gets you to give up your login credentials (or, more commonly these days, they already have part of your credentials and use this method to get you to give them the two-factor authentication code that gets sent to your phone to complete an account password change process to lock you out of the account going forward).
3)
Phishing: You get an email from a bad actor with some enticement to click on a button that takes you to a website that looks like a legit login website for some business or organization you have an account with, and enter your login details, which the bad actor captures.
4)
Malware: You somehow end up on a website that surreptitiously installs malware on your local computer, which can surreptitiously extract and transmit data back to the bad actors, such as capturing URLs visited and data entry made, which can include login credentials.
