They injected crypto donate buttons below, for example, tweets to make them look like twitter had a donate option. The sites were sent over https, it was mitm