they can do something better: they can put some javascript disabling the hijacked JS like

alert('......'); r_send = function(){}