Random examples of attacks through a non-https site with kitten articles (assuming an attacker on a shared wifi doing MITM). 1. inject javascript on the kitten

Random examples of attacks through a non-https site with kitten articles (assuming an attacker on a shared wifi doing MITM). 1. inject javascript on the kitten site that, in case if you move on to a different tab for five minutes, redirect the page to a spoofed version of the login page of your payment provider or email account usable to recover other credentials, so that if you go back to that tab you might think that your session there just expired and "re-login". 2. inject javascript on the kitten site that replaces any legitimate links to social media platforms with links to spoofed login pages for these platforms. 3. inject javascript on the kitten site that adds an overlay over the kitten videos where clicking on it prompts you to download video_player_plugin_totally_legit.exe in order to watch the kitten videos. 4. inject javascript that replaces any ads (or just adds them) with attacker-controlled ones; possibly for some targeted scams. 5. inject javascript that runs cryptomining in the background. The attacker earns some pennies, but your computer temperature and battery life starts to suck. 6. perhaps they get to inject a javascript sandbox escape - those are rare and not actively exploited at the moment but if your browser isn't up to date for some reason, then sooner or later another exploitable vulnerability will appear again in the wild. In short, any http-only site is effectively potentially fully attacker-controlled for malware delivery, as much as websites can be used for malware delivery.