It seems conspicuous that no mention of username+password theft (and/or credit-cards) appears: surely anyone with access to inject code into web pages would almost always steal that stuff?

Is it doing so?

If not - that's really bizarre - any idea *why* not ?