Report: since January, a group has been hijacking Tor exit relay nodes to perform SSL stripping attacks, peaking in May when the group ran 23.95% of all nodes (Catalin Cimpanu/ZDNet)

Catalin Cimpanu / ZDNet:
Report: since January, a group has been hijacking Tor exit relay nodes to perform SSL stripping attacks, peaking in May when the group ran 23.95% of all nodes  —  At one point, the group ran almost a quarter of all Tor exit nodes.  Group still controls 10% of all Tor exit nodes today.

source http://www.techmeme.com/200811/p2#a200811p2