I think this may have been the result of banking malware (e.g. Zeus back in the day) which was hooking OS calls to capture keyboard input and steal passwords. I'm not sure whether the on-screen keyboards would be vulnerable in other ways though.