You don't have to wait for the user to click anything. Just read each key press and send a message out.

Hard to believe this is still a common vulnerability. Of course, even in 2007 a significant number of bank and credit card web sites operated like this.