Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers seized control of over 300 Tor exit relays in early October, using them to intercept SSH connections and steal login credentials. The attack targeted the final hop in Tor circuits, where traffic exits the anonymity network toward its destination. Users who authenticated to SSH servers via Tor between October 1 and 5 using password-based login were at risk. The attackers redirected connections to rogue servers designed to harvest passwords. This represents a significant man-in-the-middle attack against Tor users relying on the network for secure remote access. The incident highlights the risks of trusting exit relays in anonymity networks for sensitive operations like SSH authentication.