Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials

Hackers compromised 333 Tor exit nodes and redirected SSH connections to password-stealing servers, according to a researcher’s account published October 20, 2026. The campaign began October 2 and targeted unencrypted email traffic alongside remote server logins.

The affected nodes represented roughly one in ten of the approximately 3,000 Tor exit relays cited in the report. Attackers reportedly gained access to the underlying Linux servers in August and installed Ebury 1.8.3, an OpenSSH backdoor and credential stealer.

Exit relays carry traffic from the Tor network to its destination. In this campaign, compromised relays forwarded encrypted web traffic normally but redirected SSH connections on port 22 to one of 12 interception servers.

The researcher discovered the activity after an SSH connection produced a “REMOTE HOST IDENTIFICATION HAS CHANGED” warning. That message meant the presented server key did not match the previously trusted key.

Hackers Hijack 333 Tor Exit Nodes

According to the account, users who ignored the warning and continued with password authentication exposed their credentials. Attackers could then connect to the intended server, watch commands entered during the session, and open another connection to try to install Ebury.

The attack therefore depended on defeating verification, rather than simply breaking SSH encryption. A changed host key was the visible warning that the connection might no longer reach the expected server.

The report also described changes to allowed ports that steered affected exits toward unencrypted mail traffic, giving attackers another source of readable data.

To identify compromised exits, the researcher built a test around exitmap, a tool for checking Tor exit behavior. Each test selected an exit relay and opened an SSH connection between two controlled servers.

One server checked the SSH fingerprint. The other checked whether the incoming connection originated from the selected exit or an interception server. About a dozen exits returned false fingerprints, while more than 300 routed connections through the same interception infrastructure.

A separate honeypot test using sshesame reportedly revealed Paramiko, a Python SSH library, on the attacker’s side. Captured commands checked user privileges and sudo access before attempting to run a Base64-encoded Perl installer.

Ebury’s role fits its established history. Cyber Security News previously covered Ebury infections affecting over 400,000 Linux servers, including credential theft and SSH traffic interception inside hosting environments.

Researcher kaba reported the findings to Tor’s network health team on October 2, and operators alerted affected relays with the BadExit flag on October 4.

Tor’s bad-relay guidance confirms that BadExit prevents a relay from serving as an exit. The project also accepts reports containing relay identifiers and evidence of suspicious behavior.

Attackers reportedly restarted several relays on October 5, but the flags prevented them from serving as exits. The account says all identified infected servers were shut down that day.

The initial access method remains unknown. A hosting-provider breach is one theory, not a confirmed finding. Attribution also remains unresolved.

The case reinforces why relay monitoring matters, a subject covered in Cyber Security News’ report on Tor’s network safety measures. For SSH users, the researcher’s central lesson is to investigate host-key warnings rather than bypass them and replace password logins with SSH keys.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials appeared first on Cyber Security News.