Firmware attacks have been demonstrated, but are complicated and expensive to perform. We don't know of any actual use against Tails users. For an example, see <a href=https://www.youtube.com/watch?v=sNYsfUNegEA>LegbaCore: Stealing GPG keys/emails in Tails via remote firmware infection</a>.
