The fake transaction carried no fee until a user manually raised it and signed, sending a payment to the attacker.