Comment by oandrei

It seems that such exploit would require some kind of `network-manager` running. But if `network-manager` is disabled, and all interfaces configured in `/etc/network/interfaces`, then the new malicious interface will be just ignored. It will not come up.