I'd like to know so I can prevent it from happening.
- Downloading and installing an app that contains malware.
That is all. If you don't want malware on your phone, just don't install malware on your phone. That means:-
When you click install on Google Play (or another app store), check the permissions. If the app asks for permissions you weren't expecting, don't install it. It's commonplace for malware authors to upload fake apps that appear to be popular or trendy games or apps, but are in fact imitations that install or contain malware. Google is pretty good at taking them down these days, but they still appear for a while. Genuine software vendors are happy to explain why they need each permission they ask for, so if you're not sure, check if the app description has a plausible explanation, and/or contact the vendor.
If you're visiting a website and it unexpectedly downloads an APK (an Android app package), don't install it. Just delete the file.
Don't install apps from warez sites. There used to be a lot of 'reputable' warez on Windows, that actually were the software they claimed to be, but on Android most of the warez sites are just viruses with different names.
If you're not expecting to install apps from APK files you got elsewhere, go into the settings, in the Security section, and turn off installing APK files from Unknown sources. You can always turn it on again when you need to.
Apart from that, on Android you still need to apply the usual security precautions you'd take with websites and emails to avoid phishing attacks and scams. Check who the sender is, check what domain you're looking at or what domain the link points to. Even if a message appears to be from someone you know or an organisation you trust, it could be malware posing as them, so think about whether you'd expect them to send this message.