By requesting access to it. To a user that just installed a e.g. step counting app that wouldn't be suspicious. Otherwise on Android apps would need to request

By requesting access to it. To a user that just installed a e.g. step counting app that wouldn't be suspicious. Otherwise on Android apps would need to request accessibility feature access to be able to monitor keyboard input into other apps (and there is an explicit warning), or, which is most common, request an overlay permission and start a "phishing overlay" if a targeted app is started by the user.