By far the most common way hackers, and I use this term loosely because they are not really hacking Runescape accounts at all, but they basically either make a website or create a forum post where they post something up along the lines of, just send me your Runescape password and username and I will hack Runescape and give all the items you want. Of course this is a complete load of rubbish and is just a way for them to hack your Runescape account once they have your Runescape password.