I did unlock my CLI wallet to send 15 Decred to web wallet wallet.decred.org Just after that somebody has stolen 282 DCR from my CLI wallet
You had 282 DCR from the air drop, sent 15 DCR, and 267 DCR went into a change address. Nothing was stolen, you just made a transaction as you intended.
A change address is generated/selected from your wallet automatically. You should not need to do anything else to get access to it. What version of dcrwallet are you running? Code: dcrwallet -V