Darkreading.com has a list of 10 most dangerous things users do online, they are:

1. Clicking on email attachments from unknown senders
2. Installing unauthorized applications
3. Turning off or disabling automated security tools
4. Opening HTML or plain-text messages from unknown senders
5. Surfing gambling, porn, or other legally-risky Websites
6. Giving out passwords, tokens, or smart cards
7. Random surfing of unknown, untrusted Websites
8. Attaching to an unknown, untrustworthy WiFi network
9. Filling out Web scripts, forms, or registration pages
10. Participating in chat rooms or social networking sites