It would be extremely difficult to answer that question with any authority without setting boundaries. You can view security reports by vendors (i.e. RSA, FireEye, Symantec, Verizon, Websense, Mandiant, Trustwave, Microsoft, etc) to review their sampling methodology, sample size, and conclusion to get a feel for the overall pulse of the industry regarding this topic. I wouldn't recommend relying on any single vendor report because of the strict boundaries each vendor places.
With that said, there are tools like sslstrip that makes it really easy for an adversary with network connectivity to logically place themselves in-line to traffic. sslstrip is smart enough to render https useless (do a search for "sslstrip" on security.stackexchange for another post re: internals).
Consider open wifi access points at coffee shops, airports, cities, etc. It's really easy for anyone to setup a malicious AP and "sniff" credentials. Much easier than obtaining a hashed password file and running dictionary attacks against the hashed password list.
At the same time, consider how widely deployed malware has become. The vendor reports above often conclude that malware is becoming more advanced as the "bad guys" organize. The bad guys are also in their business to make money so they'll make any investments necessary to earn a good payback. So, malware is becoming advanced and once infected, the bad guys can sniff traffic, redirect traffic, steal password, or even pop the CD tray open (good ol' backorifice from CDC in the late 90s).
Another way to look at the threat landscape is by following monetizable information. CC numbers, SSN, etc. Password becomes the gatekeeper for bad guys to access money. If the password authentication can be bypassed, the bad guys won't bother launching dictionary/bf/keylogger attacks because there's no reason to. So the question really becomes how bad guys get access to data that can be turned into money. The answer to "how" becomes the easiest way possible. Even with widespread adoption of EMV in the US or larger and strong cryptographic methods, the bad guys will find the easiest way to make money (how to get the best payback for their investment).