The biggest mining pools have known identities[1]. If some unknown group started mining and the hashrate jumped 50%, it would draw lots of attention. There's no way it could be done secretly. A more likely attack would be a government bribing or coercing a few of the biggest mining pools to manipulate their blocks.

[1]: https://btc.com/stats/pool