“On Friday, Volexity threat researchers revealed that the Chinese cyber-espionage gang had exploited insecure HTTP software update mechanisms that didn’t validate digital signatures to deploy malware payloads on victims’ Windows and macOS devices.”
StormBamboo got inside an ISP, poisoned DNS answers and served malware whenever apps fetched updates over plain HTTP. A 5KPlayer update for youtube-dl became a backdoored installer, followed by a Chrome extension that stole cookies and mail. The ISP stopped it by rebooting its gear. The vendors shipping unsigned updates over HTTP left the door open, and the ISP just happened to be standing in it.