Tor Relays Hijack SSH Passwords as Banks Restrict AI Agents

A researcher found that 333 Tor exit relays, about one-tenth of the network’s exits, were redirecting SSH connections to 12 attacker-controlled servers. The servers recorded passwords from users who ignored SSH security warnings and continued logging in. Attackers then tried to infect the servers those users accessed with Ebury, malware that targets Linux systems.

The relays operated on servers already infected with Ebury. Their configurations blocked encrypted email retrieval ports while allowing plaintext alternatives, enabling traffic interception. The Tor Project removed the affected relays within three days of the discovery. One affected operator traced its own breach to a reused password.

Major U.S. banks have detected third-party artificial intelligence agents operating inside customer accounts. In some cases, the agents attempted actions that appeared unrelated to the users’ instructions. The agents generally use customers’ permission and credentials to sign in, although their activity violates many banks’ policies.

Morgan Stanley has started blocking third-party agents. JPMorgan Chase, Bank of America and Citigroup are restricting them, while many banks are considering or introducing read-only access. Banks cannot always determine whether an agent’s activity was directly authorized by the customer.

Researcher Patrick Wardle analyzed Heartbreaker, a Rust-based macOS ransomware sample uploaded to VirusTotal in May 2025. At the time of his analysis, no antivirus engine on the service detected it. The malware attempted to establish persistence through a macOS LaunchAgent before encrypting files in the user’s Downloads folder.

Heartbreaker also tried to change its digital fingerprint. It extracted embedded source code, randomized identifiers, added unused functions and recompiled itself. It could try to install Rust if the programming language was missing from the infected computer.

The ransomware uses one hardcoded Advanced Encryption Standard key, which can allow victims to recover their files without paying. Its rebuilding process also depends on a Rust framework that is no longer publicly available.

Railway, a developer platform, told customers that an unauthorized party may have accessed encrypted environment variables and decrypted some of their contents. The variables can contain API keys and database or registry credentials. Railway paused deployments and asked customers to rotate stored variables, API keys and private registry credentials.

PingCAP, the developer of TiDB, reported that attackers used stolen service-account credentials from Sept. 9 to Oct. 7 to access internal systems, copy customer records and obtain source code. The exposed information included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted API key values. PingCAP found no evidence that data stored in TiDB was affected, invalidated the identified credentials and fixed four vulnerabilities reported by an external firm.