Also see bunnie's recent blog post about how such an attack is not only not particularly sophisticated, but surprisingly affordable to do [1], which is scary considering how hard it is to detect (discussion here [2])
[1]: https://www.bunniestudios.com/blog/2024/turning-everyday-gad...