The MD5 hash collision attack that hijacked the Windows Update system back in 2012 was replicated with just 65 US cents worth of cloud computing fees. The attack has been previously used by the Flame malware that spoofed its signing code with the one from Microsoft`s certificates using MD5. Nathaniel McHugh used an open source application dubbed HashClash and modified it to separate images to generate an identical MD5HashHashHashAlgorithm. McHugh: “I cannot think of a single case where the use of a broken cryptographic hash function is an appropriate choice””]
Source: https://www.bitdefender.com/blog/hotforsecurity/md5-hash-broken-via-collision-attack-of-less-than-1/