It's not too different from what I can tell. They seem to just exploit the fact that beamforming information (BFI) is transmitted back to the access point. BFI is ultimately not so different from CSI. What they exploit is that they can just listen in and intercept the BSI without access to the AP.