[dahdum]

Do you run any type of ad network on your site? The hijacking can be rather targeted (geo, device, time of day, etc..) such that you could never recreate on your own.

I still see this occasionally on otherwise innocuous sites.

Other 3rd party JS can still cause it, but ad networks are the most common.

[boole1854]

No, there were no ads anywhere on the domain in question.

There was text on the page that matched the name of a large financial institution. My suspicion is that this caused the problem.