A Volunteer Found the Hijacked Tor Relays Set up to Steal Passwords
The Tor Project's network health team has taken 333 exit relays out of service after they were caught redirecting login connections to servers run by attackers, according to a post-mortem published Oct. 20, 2026, by the volunteer who found them. The relays were marked as bad exits on Oct. 4, 2026, a flag that stops Tor clients from using them to leave the network.
Exit relays are where traffic leaves Tor for the ordinary internet, so whoever runs one sees anything that is not encrypted. The report puts Tor's exit pool at around 3,000 relays, which means roughly 10% of it was in the attackers' hands. Encrypted web traffic passed through normally, so nothing looked wrong until a user opened an SSH session, the standard remote login for servers. Those sessions were steered to one of 12 interception servers.
A user who clicked past the resulting warning that the remote host's identity had changed handed over their password, had their typed commands watched, and had the machine they were logging in to infected with Ebury, which the report describes as an OpenSSH backdoor and credential stealer for Linux. The same software had been placed on the relay servers two months earlier, in August.
The post's author says he found the relays after his own connection was redirected on the morning of Oct. 2, 2026. Using two of his own servers, he tested every exit relay in the network to see which ones sent the connection somewhere other than its destination, and then gave the list to the network health team that evening. He quotes the team as telling him, "We've not seen an attack like that before." Operators began shutting relays down after the team's announcement, and the report says all the infected servers were off by Oct. 5, 2026.
How the attackers reached so many servers at once is still unknown. The report says one theory under discussion is that the hosting company itself was hacked, but that nobody really knows. Its own advice to readers is to turn off password logins for SSH in favor of keys.
