Can an attacker create many nodes that approve blocks without work?
You're essentially talking about a "fork" - or a separate chain. It wouldn't and couldn't interface with bitcoin - merely work (at best) alongside it. Exchanges, merchants, and official bitcoin wallets could not be fooled into using this alternative. Someone would have to download a compromised client. As each block refers to the previous one, there would be no way for them to "inject" fake blocks in the way.