Attackers hijacked 333 Tor exit nodes to steal SSH passwords

Attackers who had quietly compromised 333 Tor exit relays, about a tenth of the network's roughly 3,000 exits, redirected SSH logins to interception servers for three days in early October, stealing passwords and harvesting unencrypted email before the Tor Project shut the relays down.

Why it matters: Anyone who accepted a changed host key warning and logged in by password through Tor between October 2 and 5 may have handed attackers their credentials and had their server infected, so affected passwords need rotating even though the network has already removed the relays.

Data as of Researcher Kaba's account of October 20, 2026, read in full at kaba.cx, corroborated by The Hacker News of October 21 and Ars Technica of October 22, 2026. How the attackers first entered the servers, and who they are, remain unknown. Developing item.

Attackers gained access to the servers behind 333 Tor exit relays in August and quietly installed Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux, then launched the interception on October 2. The relays forwarded encrypted web traffic normally, but an SSH connection on port 22 was redirected to one of 12 interception servers, while the relays’ port settings steered them unencrypted email traffic to collect.

A user who ignored the changed host key warning and logged in anyway had their password stolen, their session watched command by command, and their server infected with Ebury through a second connection. The researcher who found the campaign, publishing as Kaba, tested all of the network’s roughly 3,000 exit relays, reported the results to the Tor Project’s network health team on October 2, and the relays were flagged BadExit on October 4 and shut down by October 5.

Attackers hijacked 333 Tor exit nodes to steal SSH passwords

Sources