What can they do? Not a whole lot: unlike a passport, a visa is not considered a valid form of identification, so it can't be used to verify a (fake/cloned) identity and it can't even be used to enter a country without a matching passport.
That said, while visas vary considerably, some do include sensitive information like your full legal name, your birthdate, your place of birth etc, all of which are useful building blocks for identity theft.
Re: proof of identity and original documents, I applied for a new credit card last week and all I needed for it was scans of my IDs and some docs that would be fairly easy to falsify, like payslips. So, yes, it's entirely possible to get credit using somebody else's passport scan without showing physical ID.