Thinking more about it, this kind of attack may be less effective on users who don't have massive WAN and LAN bandwidth. 700MB probably comes in more or less instantly on their network. A normal user on a normal network may notice that the file is taking a long time to download and get suspicious.