With large-scale distribution network user-side heterogeneous power Internet of Things devices (referred to as distribution network user-side IoT devices, UPIDs) integrating into power systems, the dominance of load control service for users on the Internet is becoming increasingly obvious. Thus, there is a cross cyber-physical domain attack path in power systems, manipulation of demand (MAD) attacks, which causes the power system to face a new type of cybersecurity threat. In this background, the research on MAD attack strategy has important guiding significance for power systems to resist such type of cyber attack. Firstly, this paper describes how hackers use distribution network UPIDs to carry out MAD attacks and their characteristics, and further gives constraints of abnormal loads in the power system based on the operation characteristics of loads and power equipment. Then, the MAD attack strategy to induce transmission line fault under the low-cost condition is proposed, pointing out the vulnerability of transmission lines in power systems under this type of MAD attack scenario. Finally, multiple IEEE node system simulations under multiple scenarios verify that MAD attacks can affect power system operation security at a low cost.