Tor hides who you are. It does not hide what you send once your traffic leaves the network, and someone has just exploited that gap at scale. An unknown attacker compromised 333 Tor exit nodes and turned them into man-in-the-middle relays. With just over 3,000 exit nodes active at the time, roughly one in ten was affected. The nodes have since been removed, but key questions remain unanswered.
What the hijacked nodes did
A security researcher based in Switzerland spotted the activity and described it in a blog post. Starting on October 2, 2026, the 333 exit nodes suddenly began redirecting unencrypted email and SSH connections. SSH traffic on port 22 was routed through one of twelve servers controlled by the attacker.
The consequences could be serious. Anyone connecting to a server over SSH through Tor who clicked past a host key warning risked handing over their password. From there, the attacker could read commands in transit and take over the target system.
Hacked operators and a familiar piece of malware
The Tor Project's network health team confirmed the incident in its own advisory on October 5. Over the preceding weekend, it had received reports that some operators' relays were intercepting SSH connections. The operators said their servers had been breached and their Tor configurations altered. In some cases, the attacker had even converted regular relays into exit nodes to widen their reach. The Tor team kicked the affected servers out of the network and asked all operators to audit their machines.
How the servers were breached in the first place is still unknown. According to the researcher, the campaign likely started back in August. The traffic redirection reportedly relied on Ebury, a long-running piece of malware that hooks into SSH and has been found on more than 400,000 systems worldwide since 2009.
Takeaways for you
- Take host key warnings seriously. If your SSH client reports a changed fingerprint, stop instead of accepting it.
- Use keys, not passwords. With public key authentication, an interceptor cannot capture a reusable password. Ideally, disable password logins on your servers entirely.
- Tor is not encryption. Whatever leaves the exit node unencrypted is visible to its operator, so make sure mail and other protocols run over TLS.
- Check your own boxes. If you run Tor relays or other public Linux servers, look for signs of Ebury, such as tampered SSH binaries or libraries.