All the attacker will do is to create is own byteball network fork that everybody will ignore.
With social engineering (sockpuppeting on BTT, for example) "everybody" will be changed to "some".
That's what I think. And the main chain will follow the 'fork' because of the number of units inside (and then the honestly posted units - with good witnesses - will no longer be selected on the subsequent main chain)