1. If you click un-trusted souce. Usually you will get it thru your email, its called Phishing
2. if you click something on the internet.
3. google ads-on for crypto. Sometimes hackers also exploited vulnerabilities on those software
4. you used phishing site. There's a lot of cloned sites that imitate MeW so be careful.
5. Of course sharing your privatekeys to someone.