Hacker News Reader

Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.

That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.