# Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

**URL:** <https://forums.thehomestack.io/t/attackers-hijacked-over-300-tor-exit-relays-to-intercept-ssh-connections/26532>\
**Category:** The Hacker News\
**Created:** [October 21, 2026, 11:24am UTC](https://forums.thehomestack.io/t/attackers-hijacked-over-300-tor-exit-relays-to-intercept-ssh-connections/26532 "2026-10-21T11:24:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![robinhood1995](https://forums.thehomestack.io/letter_avatar_proxy/v4/letter/r/48db29/32.png) [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\
**Post date:** [October 21, 2026, 11:24am UTC](https://forums.thehomestack.io/t/attackers-hijacked-over-300-tor-exit-relays-to-intercept-ssh-connections/26532/1 "2026-10-21T11:24:11Z")

</div>

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.

Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception

* * *
This is a companion discussion topic for the original entry at [https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html](https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html)