Many high-profile commercial carriers will do deep packet inspection of the traffic from their end users, so that they can do insertion of their own ads into whatever content you may be surfing. Including on your webmail pages.

And their ad networks might well be infected with malware. But because of deep packet inspection and editing, you can't tell that the malvertising in question actually came from AT&T or Spectrum instead of Gmail.