I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...

I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.