In this paper, we consider a malicious attack issue against remote state estimation in cyber-physical systems. Due to the limited energy, the sensor adopts an acknowledgment-based (ACK-based) online power schedule to improve the remote state estimation. However, the feedback channel will also increase the risk of being attacked. The malicious attacker has the ability to intercept the ACK information and modify the ACK signals (ACKs) from the remote estimator. It could induce the sensor to make poor decisions while maintaining the observed data packet acceptance rate to keep the attacker undetected. To maximize the estimation error, the attacker will select appropriate attack times so that the sensor makes bad decisions. The optimal attack strategy based on the true ACKs and the corrosion ACKs is analytically proposed. The optimal attack time to modify the ACKs is the time when the sensor’s tolerance, i.e., the number of consecutive data packet losses allowed, is about to reach the maximum. In addition, such an optimal attack strategy is independent of the system parameters. Numerical simulations are provided to demonstrate the analytical results.