An unknown threat actors have been using the malicious exit nodes to the Tor network for over a year (more than 16 months) to carry out SSL-stripping attacks. The attacks became known back in August 2020, all thanks to a security researcher known as Nusenu, who is also the operator of the Tor exit node. At the height of the operation, the attackers controlled approximately four hundred malicious Tor exit nodes. The main reason for the success of this operation is that the attackers added malicious nodes in small numbers, quietly creating an impressive infrastructure.”]
Source: https://gbhackers.com/tor-exit-nodes-intercept-traffic/