Can an attacker steal a very recent tx and alter it, broadcasting a new tx with his address on the output?
In a typical transaction, every signature in the transaction is a signature over all the outputs. So you can't change any of the outputs without invalidating all the signatures.