Threats · 1 day ago
Researcher kaba found 333 Tor exit relays redirecting Secure Shell (SSH) connections to 12 interception servers in an October 2 scan, after attackers changed relay policies between October 1 and 4. At its October 4 peak, the altered exit policy covered 7.46% of Tor exit capacity. The Tor Project began flagging relays that day; none remained in the network consensus by October 5.
An exit relay’s policy controls which destination ports it carries. Attackers changed relay configurations to allow port 22, then routed SSH connections to servers that presented their own host keys. Users who accepted a changed key and logged in with a password could expose that password to the interception server.
For operators whose Linux hosts were compromised, disappearing from Tor’s consensus stopped clients selecting those relays but did not establish that the hosts were clean. Users who accepted changed keys and entered passwords during the affected period face a separate credential exposure.
2 sources covering this story
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed host keys.
Part of the PlainSec briefing for 2026-10-23