How does a botnet client gain access to the user's username and password?

How does a botnet client gain access to the user's useame and password?

I assume it must then send these details as well as the user's IP address to the CnC server.

Does it use some kind of phishing method or is the sensitive data easier to access than expected?