🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.
A researcher found 333 exits redirecting SSH traffic to 12 interception servers.
The #TorProject has since blocked the affected relays.
#TorBrowser #Anonymity
Here's how the attack worked:
Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:
npub1al…hr5fj
2026-10-21 23:22:13 UTC
Author Public Key
npub1al4kgl9l6k0ha8acraw9vaanua704pd6zhy6j55rj2pra6c2f0uqqhr5fjSeen on
wss://relay.ditto.pubPublished at
2026-10-21 23:22:13 UTCEvent JSON
{
"id": "185004685980fb335bc524f94aed08c3c822a638fd409ca3124c6074e7390441",
"pubkey": "efeb647cbfd59f7e9fb81f5c5677b3e77cfa85ba15c9a9528392823eeb0a4bf8",
"created_at": 1792624933,
"kind": 1,
"tags": [
[
"t",
"torproject"
],
[
"t",
"torbrowser"
],
[
"t",
"anonymity"
],
[
"proxy",
"https://kolektiva.social/users/youranonriots/statuses/117481467661778357",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.\n\nA researcher found 333 exits redirecting SSH traffic to 12 interception servers.\n\nThe #TorProject has since blocked the affected relays.\n#TorBrowser #Anonymity\nHere's how the attack worked:",
"sig": "3d89afb994c0af8ceccf730f87bd0a9534ac10f8bf7905057bc4c3e9c480dfc02423f3e44060b78db1ec4bc027102225046f349d6147859621669318dfba2687"
}