The attacker can't steal your money. All the attacker can do is change your transaction ID, then re-transmit it very quickly to send Bitcoins to the same address they were originally intended to be sent to. One of the transaction IDs has to be accepted by the network,and the other has to be discarded. Your Bitcoins still get sent to the address they were intended to go to, but sometimes they arrive with a different transaction ID than you were expecting if your transaction gets attacked.
Yes that's all they can do but it affects certain transaction which rely on the transaction ID, for example if you're live betting and you send in a bet, it gets accepted but then the other one is sent with different ID and the 2nd one gets confirmed and by that time the odds have changed, one other affect of it is, someone I know reloads his mobile using BTC, so he sended the BTC and waited but never received his reload because his transaction under original ID was never confirmed and the other one did but the website didn't recognize that as it relies on the Tx ID.
And OP it is still going on, I did many transactions today and couple of those were resent using different ID and thankfully it didn't affected anything, other than the Blockchain.info warning saying that this address has double spends.