[cesarb]

> That's assuming the attacker regains control, so you'd have to visit a malicious page every time the attack needs to be re-initiated.

Every non-HTTPS page can be considered malicious, if the attacker can do a MITM.

Since the attacker can capture the encrypted traffic, he most probably is in the middle and can do a MITM.

Therefore, if you are under this attack, every non-HTTPS page is malicious.