I'm staring at my MAC now and wondering if my Little Snitch will prevent this type of hijacking. I expect the firewall to ask me how to treat a new interface before sending packets there.
Here is a detailed post: https://blog.obdev.at/automatic-profile-switching/