Can, but it’s a highly sophisticated attack that hasn’t been reported in the wild. This is Ars Technica’s article that I suspect is higher-quality than TechSpot’s (but TechSpot discusses at least one point Ars doesn’t; it isn’t superfluous.)