Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections in Early October

A cybersecurity researcher reported that in early October 2026, over 300 Tor exit relays were hijacked by an unaffiliated threat actor. Exit relays serve as the final hop in the Tor network, where traffic exits the encrypted tunnel and travels to its destination. By compromising these relays, the attacker was able to intercept SSH connections routed through Tor during the window of October 1 to 5.

The attack worked by redirecting SSH traffic from users to servers controlled by the actor. These rogue servers captured login passwords, relying on the fact that users connecting via Tor often accept connections without verifying security certificates.

The Tor Project confirmed that the compromised relays have been revoked and is conducting a thorough investigation. The organization has urged users to update to the latest version of Tor Browser, refrain from using Tor for sensitive SSH connections until the network stabilizes, and transition to SSH key-based authentication to mitigate the risk of credential theft.

This incident highlights the importance of relay operator security and the potential impact when trust boundaries within privacy networks are compromised.