Sure, but he still needs access to the L2 network, the virtual interface has to be connected/bridged to something. Unless if you're thinking about a virtual in

Sure, but he still needs access to the L2 network, the virtual interface has to be connected/bridged to something. Unless if you're thinking about a virtual interface and dhcp server directly on the victims pc (bridged to the interface with the dhcp client), but if the attacker can do that, he can also just capture the data directly.