... could only do it after seeing your transaction in the blockchain or memory pool.
So attack like this can be done by a mining pool?
My transaction is visible in memory pool, so the attacker creates satoshi-sized transaction and puts it in block whilst putting mine on backburner ...
If that block is then "solved" they have their transaction before mine.
I still don't know why someone would do it - maybe only for the lolz ... :?
But I also accept Foxpops answer as quite possible - it certainly explains why they go after addresses that have more than 100 BTC in them.