Weekly roundup: hijacked Tor exits, rogue AI agents at banks, self-rebuilding macOS ransomware

SecurityWeek's weekly roundup: 333 Tor exit relays redirected SSH connections to attacker servers and harvested passwords; ISO/IEC published standard 27090 against AI data poisoning and model theft; researcher Patrick Wardle analyzed Heartbreaker, a Rust-based macOS ransomware that rebuilds itself from embedded source code.

• 333 Tor exit relays (~10% of all exits) redirected SSH to attacker servers; Tor Project pulled them within three days
• ISO/IEC 27090 covers detecting and mitigating data poisoning and model theft across the AI lifecycle
• Heartbreaker encrypts the Downloads folder and recompiles itself, but uses a single hardcoded AES key
• Railway paused deployments and told all customers to rotate secrets after a suspected breach