🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.
A researcher found 333 exits redirecting SSH traffic to 12 interception servers.
The #TorProject has since blocked the affected relays.
#TorBrowser #Anonymity
Here's how the attack worked:
Anonymous 🐈️🐾☕🍵🏴🇵🇸 :af:
npub1e7…pet6n
2026-10-21 23:22:13 UTC
Author Public Key
npub1e7vzg8ryv42fve4kt5q3t8404xkrqdqe58y27mttshf5dw29vpcqrpet6nSeen on
wss://relay.momostr.pinkPublished at
2026-10-21 23:22:13 UTCEvent JSON
{
"id": "666b1d53f3d3220d65ae867164ca695799f1aae52b88e8e1289c7dc5c1dd951d",
"pubkey": "cf98241c6465549666b65d01159eafa9ac303419a1c8af6d6b85d346b9456070",
"created_at": 1792624933,
"kind": 1,
"tags": [
[
"proxy",
"https://kolektiva.social/@youranonriots/117481467661778357",
"web"
],
[
"t",
"anonymity"
],
[
"t",
"torbrowser"
],
[
"t",
"torproject"
],
[
"proxy",
"https://kolektiva.social/users/youranonriots/statuses/117481467661778357",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://kolektiva.social/users/youranonriots/statuses/117481467661778357",
"pink.momostr"
],
[
"-"
]
],
"content": "🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.\n\nA researcher found 333 exits redirecting SSH traffic to 12 interception servers.\n\nThe #TorProject has since blocked the affected relays.\n#TorBrowser #Anonymity\nHere's how the attack worked:",
"sig": "34085fb5e1dc09b83b83b3c68bae8f10942dea9e2d44c1ec61a7935ebf2993bee07662dbf4b6e7f5340843379b479266491bef72b2abf956df18934dd151d843"
}