Well, they can't unless they have physical access to your computer or phone, with the wallet unlocked.

So either you've been the victim of phishing, or your device is compromised. Or, if you were storing your keys on LastPass, they have been hacked recently, so that could come from there.

On Keychain side, nothing is stored online.