Extremely trivial and common, see captive portals. They're not malicious, but could easily be. You can intercept and inject anything you want if you control th

Extremely trivial and common, see captive portals. They're not malicious, but could easily be. You can intercept and inject anything you want if you control the network with HTTP. Also, e.g. spoofing an unsecured WiFi network is pretty easy. Even on wired networks, do you know what path your traffic is taking? With HTTPS, it doesn't matter.