Not exactly, that's what bcrypt and scrypt are for. Attackers would have to modify the running code to divert raw passwords elsewhere, which would be a lot more noticeable.