Random sites usually, they have malicious scripts on the webpages.
You go to one and it auto-steals "grabs" your saved cookies, then decodes them to get your passwords.
Best ways to protect yourself are to check your browser settings to block/disallow certain scripts (Google for exact details), install latest updates to your browser, or use a better browser.
Nevertheless, hackers are always finding new ways to circumvent security, so you can never fully block a cg, just protect yourself best you can.