Tor's advisory on hijacked relays gives no count or cause. Researcher Kaba counted 333 of about 3,000 exits redirecting SSH to interception servers from Oct 2 and says attackers tried to install Ebury. An AI-assisted public-data analysis counted 377 relays with changed exit policies, 71 of 101 other-operator FranTech relays vs 13 of 9,054 elsewhere. Operator Quetzalcoatl blames its own reused plaintext password for two rooted servers.
kaba.cxHow I got over 300 Tor exit nodes removed