You can call `document.location=http://badsite.com; e.preventDefault();` in a click (mousedown, mouseup, mouseclick) handler, too. You aren't going to ever prevent this kind of thing from being possible without killing the modern web as we know it.

Instead of making a big deal out of it (phishing 2.0? really?), why not focus on phishing detection and prevention instead? I do it by using LastPass with randomly generated passwords that I don't actually know. I have to go to LastPass for my login information, and it provides information filtered by the domain I'm on. If I'm on badsite.com rather than paypal.com, LastPass won't offer my PayPal information to fill. Problem solved.