Comment by icebraining

Sure, against a complete stranger the web server might be more vulnerable, but sometimes the attackers are already in our LANs :)

I was thinking more about employees, or students at universities, or such. I believe I've seen tools that ARP-spoof and then automatically detect downloads of ELF or PE files and trojanize them, all without requiring almost any knowledge from the attacker. I don't know if any of these tools detect Putty and fix its signature too, but it wouldn't be hard to do.