It could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2].
The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example.
The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example.
[1] https://github.com/secretsquirrel/BDFProxy
[2] https://www.pcworld.com/article/2839152/tor-project-flags-ru...
[3] https://en.wikipedia.org/wiki/Zeus_(malware)