Phillip already gave a great overview of how how most bots operate, but I just wanted to cover things in a little more detail, as I have a bit of personal experience developing on or for all the types of bots he covered.
In Runescape, there was a large project (RSBot) that would copy the contents of memory from the Runescape client into its local memory, where it could then view the entire state of the game with no risk of the client catching on. It required a bit of reverse engineering to determine where in memory to look in order to find the pointers to the data, but once they had done so, they exposed an API to take advantage of the information. It would know exactly what was where in the world by getting the coordinates of an object and then transforming them with the camera transform matrix to get the on-screen position. The hit masks were also readable, so it was trivial to determine exactly what range to move the mouse into in order to get a desired result.
The bot provided a bunch of debugging information, such as annotations that told the developer which tile coordinates are where, which ID this object has, what ID belongs to a given item, etc. This information could then be used to make bots. The actual process of making the bot scripts was actually quite simple. The framework provided many utility functions, such as
mouse_move(x,y) which would perform the specified actions in a somewhat believable way (moving the mouse along a random spline, repeatedly moving via both the minimap and screen, and so on)
Also in Runescape, you have the option of drastically reducing the quality of the graphics. It was actually pretty easy to make certain kinds of bots by filming the screen and applying some basic computer vision concepts in order to construct a model of the world. I made both a curse bot and smelting bot using this technique, both of which worked quite well. It would just take the frame, increase the saturation as much as it could, and then try to extract patterns from it which it could then generate a probability map for click zones.
In the case of the curse bot, the target was a lesser demon, which is just a huge red thing, which is trivial to find. In the case of the smelting bot, it would look for a small orange trapezoid surrounded by grey, and that would be the furnace. It would also try to find a large, light-grey 'L' shape, which would be the bank desk. That was just done with downscaling and basic heuristics. It could also orient itself with the handy compass next to the minimap, so it could orient the camera in a more reliable position to find the target objects.
In various Nexon games, the servers are very trusting of the clients. I abused this a ton in Maplestory by modifying maps to remove hazards or add warps so that a bot doesn't have to be nearly as sophisticated. I would also monitor the traffic to and from the server in order to build a model of the world which could then be used to quickly find and kill monsters.
Once I realized that I didn't actually play MMOs anymore and just automated them, I decided to stop playing altogether. If I wasn't as worried about exposing myself legally, I could have probably made a killing selling MMO bots, but I really didn't want to get sued. That is why I spend my time doing real programming these days!