This probably does not exist yet in the wild, but a team from Newcastle University has done it in the lab with 70% accuracy. It involves using the phone's motion sensor to determine which keys have been pressed. Presumably a malicious app could do this. See https://www.futurelearn.com/courses/.../0/steps/19609

I didn't read all of the info but as this is based on motion sensors and gyroscopes, just put the phone down on a hard and securely fixed surface such as a desk or push it against some wall. (May add scratches but new back covers are cheap.) Then it will not move at all when entering the pin or other potentially sensitive information. (I'm not sure how sensitive those sensors are exactly, but with no motion at all there will be nothing to sense.)
BTW: My smartphone is so old it only has (not very accurate) tilt sensors, so I think I'm safe. Others might want to check what their phone has... and try to not install anything that claims to change your entire life and triple your income - it's 95% safe to assume that software is malicious.