Blue Coat Proxy SG is just a proxy. It does not include malware.
What Blue Coat's Proxy SG and other similar solutions does is a MITM attack on encrypted traffic. It decrypts incoming traffic does whatever it is configured to do with the decrypted information and then encrypts the data again before forwarding it. This is pretty simple. (I know, I with others wrote a MITM proxy about ten years ago.)
Once you have the MITM proxy, it must be placed in the right location. There is evidence of Blue Coat products in public networks: https://citizenlab.org/2013/07/planet-blue-coat-redux/
Once you have the MITM proxy in the right place, what is required to perform a MITM attack is a trusted certificate. Browsers trust a large number of root certificates. They also trust intermediate CA certificates signed by these root certificates. Thus, this is a matter of acquiring such a certificate and loading it into a monitoring device. Any CA certificate which is trusted by browsers will do. The larger the number of CAs trusted by the browser, the lower the security. (Whether the monitoring device is sold by Blue Coat or not is irrelevant here.)
Certificates can be bought. They can also be obtained from a broken CA. (Look for the Comodo and DigiNotar hack stories). Also, according to the EFF, 54 states control CA which are trusted by browsers: https://www.eff.org/files/countries-with-cas.txt
You might find these links relevant:
(The MITM device in which the certificate was loaded in the first case might or might not be from Blue Coat. This is not known.)
Also, users tend to ignore security warnings. A trusted certificate is not required if it can be predicted that the victim will ignore the security prompt: https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook
Another possibility is to exploit a vulnerability or to bribe an insider to acquire the server's private key.
Countermeasures have been developed to block these attacks, such as certificate pining (Chrome does this for a few large domains) and Certificate
The Perspectives project designed as system in which a higher number of trusted third parties translates into better security. (Compare with the PKI model where the higher the number of trusted third parties, the lower the security.)
Malware used to compromise a target's computer is an entirely different threat. SSL/TLS is does not offer any protection to the victim in this case. This is what the NSA did to attack Tor users.