According to the article, Amnesty International assumes, that the Journalist in question was targeted by http-MITM attack. This assumptions nicely fits into pop

According to the article, Amnesty International assumes, that the Journalist in question was targeted by http-MITM attack. This assumptions nicely fits into popular "http is bad, https is good" narrative, but it is just a guess (and probably is far from truth). Modern browsers support multiple network code paths, several HTTP versions, dozens of TLS versions and boatload of ciphers. All of that code has RCE bugs. Besides, delivering vulnerability payload via advertising network is far more reliable — with http-only exploit chain police would have to wait and hope that Omar will someday visit an http-only site. I would expect a pricey exploit toolkit, used by governments, to be more robust than that.