Tag obfuscated JavaScript attack