Yeah a lot of you don't realize that even with gorillians of dollars of VPN and internet security you neglect the simple things… every keystroke you make is being recorded through your operating system and retrieved through backdoors. The software could even be in the firmware (built-in software for hardware) of your keyboard or even the individual components that make up your PC. Even if you're offline when doing things, it can be recorded into a file somewhere and sent out to malevolent agents the next time you connect to the internet.
The software required to accomplish this would only be a few lines of code, none of it is hardcore Hackerman levels of understanding. Although it is easy to hide this code in an OS; Windows is made up of hundreds of millions of lines of code.