Seriously this is all greek to me or should I say geek...what this means?
As I understand it, there are internet nodes that can operate anonymously, bypassing the standard nodes normally used. These TOR "nodes" will allow a user to operate anonymously by acting as a PROXY sending on the users' requests, with a spoofed address, and then handling the return responses and returning them to the correct addressing, and not leave a traceable trail of where the users goes on the Internet.
A few of the "exit nodes," those returning the data to the user, are intercepting upgrade packets for software or operating system security upgrades, and secretly acting as Man-in-the-middle servers, taking the incoming packets from their originating true servers coming from, say Microsoft, adding malware, and then sending them on to the users. They are apparently also spoofing the security certificates in some way. That is difficult to believe.
Does that help?