Of course, it is perfectly common and is a standard part of the feature set of all advanced modern-day commercial malware, and has been widespread since the first versions of ZeuS. The page visited via the legitimate URL is normally partially or completely modified on-the-fly.
It is normally achieved by injecting into the browser process and hooking WinAPI system calls, which contain raw HTTP request and response data. This article contains the full list of hooked API calls for ZBot, if you're interested.
Of course, injecting into the process means that the malware should often target specific browser versions. Malware authors commonly list the browsers and their versions which their product can inject, and often update their malware right after the target browsers' update (if they want to stay on the top of the market).
ZeuS, its various modifications, SpyEye, and most other bots with the "browser injection" capability sport a very interesting feature: a small built-in "parsing & replacement language" for their config files that allows malware users to easily configure the changes in HTTP responses for specific pages.
This language is basic text-replacement stuff: one can specify the URL or URL mask for the responses to be modified, and then give a list of replacement blocks, each specifying some data to be inserted (the "body"); data in the original response after which the "body" should be inserted and/or data in the original response before which the "body" should be inserted.
Configs written in this "language", referred to as "injects" or "webinjects", are an actual market of their own. Well-written "webinjects" targeting banks or online payment systems, with their own well-written administration web-panels, can sell for several hundred dollars.
This is mostly used, as you have correctly stated, for phishing. However, it is different from regular phishing in being much harder to identify. It's also often used for advertising and clickfraud.