Attackers hijack 333 Tor exit relays to intercept SSH connections and steal passwords

A researcher who publishes as kaba scanned all of Tor's roughly 3,000 exit relays on October 2, 2026 and found 333 of them redirecting SSH connections to 12 interception servers. The relays were not run by the attackers: the operators' servers had been broken into first, and Ebury 1.8.3, an OpenSSH backdoor and credential stealer, had been installed on them. On October 1 the infected relays were reconfigured to open SSH and to block encrypted mail ports while leaving plaintext mail ports open.

A user whose SSH client warned that the remote host key had changed, and who accepted the new key and typed a password, handed that password to the interceptor, which relayed the session to the real server and watched the commands typed. The infected relays peaked at 7.46 percent of Tor exit capacity by consensus weight on October 4. The Tor Project's network health team flagged the relays BadExit on October 4, and by October 5 none remained in the consensus. No victim count exists; the users at risk are those who used password based SSH over Tor between October 1 and 5 and accepted the changed host key.

Sources: SecurityWeek; Safeguard