Doesn't work, because of cross-domain security policies. Javascript running in http://malicious-site http://malicious-site wouldn't be able to read the CSRF pro

Doesn't work, because of cross-domain security policies. Javascript running in http://malicious-site http://malicious-site wouldn't be able to read the CSRF protection token in the fund transfer form on http://bank http://bank. So the submission wouldn't have the correct token value and the bank would reject the attempt.