IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.