BINGO!!! OP doesn't understand that this kind of attack (or most attacks for that matter) aren't targeted to the sophisticated user, its targeted to the majori

BINGO!!! OP doesn't understand that this kind of attack (or most attacks for that matter) aren't targeted to the sophisticated user, its targeted to the majority of the population. The majority of the population isn't running noscript, is using the vanilla settings that the browser came with (which means javascript is turned on) and doesn't think twice about entering in their credentials into a site that they trust.