Attackers hijacked over 300 Tor exit relays in early October 2026, modifying their exit policies to intercept SSH connections by redirecting them to malicious servers that stole login passwords when users accepted fake host keys. The compromise was linked to the Ebury backdoor, installed via stolen credentials on relay operator servers, enabling persistent access and interception of encrypted SSH traffic tunneled through Tor; the Tor Project identified and removed the malicious relays by October 5. Operators affected are advised to check for signs of compromise, treat any passwords entered during the attack window as stolen, and reinstall systems after removing infected relays.
https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html