Vulnerabilities · Threat Intelligence · Privacy
Hackers hijack 333 Tor exit nodes to steal SSH passwords and emails
Hackers took control of 333 Tor exit nodes to intercept SSH passwords and try to read unencrypted emails. The attack lasted three days and targeted users ignoring security warnings.
Ross GrantUpdated 2 min read
The short version
Hackers broke into hundreds of Tor exit nodes and changed their settings to steal passwords and read unencrypted emails. They targeted people using Tor for remote logins (SSH) and email, especially if they ignored security warnings. The attack only lasted a few days, but anyone using Tor during that time could have been at risk. Experts say always use encrypted connections and pay attention to security warnings.
By the numbers
- 333Tor exit nodes hijackedArs Technica
- 3 daysduration of the attack (October 2–5, 2026)Ars Technica
- 12attacker-controlled SSH interception serversArs Technica
What happened?
Hackers took control of 333 Tor exit nodes for three days in early October 2026, according to Ars Technica. They redirected SSH traffic to servers they controlled and tried to force email connections to downgrade to unencrypted, so they could steal passwords and read messages. The attack targeted users who ignored security warnings. It is not clear how the attackers gained access to all the nodes.
How the attack worked
Unknown attackers hijacked 333 Tor exit nodes for three days in early October 2026, according to Ars Technica (opens in a new tab). The attackers first gained access to a Tor management server using a reused password. They installed Ebury, a Linux backdoor, then used the compromised server to access a second Tor server (called Switzerland2) via SSH. The method for this second access is unclear, as the SSH key used was not listed in authorised keys. Ebury was installed on Switzerland2, and its exit nodes were reconfigured.
The attackers changed the settings on hundreds of exit nodes to redirect SSH traffic (used for secure remote logins) to 12 servers they controlled. If a Tor user tried to connect to a server using SSH and ignored warnings about a changed host key, the attackers could steal their SSH password and watch all commands typed. In some cases, they also used this access to infect the user's server with Ebury.
For email, the attackers blocked ports used for encrypted email (such as 465, 587, 993, and 995) but left ports for unencrypted email open. This forced some email connections to downgrade to unencrypted, allowing the attackers to read messages in plain text if the connection was not secured.
Who is affected
Anyone using Tor for SSH connections or email during the three-day window (October 2 to October 5, 2026) could have been affected, especially if they ignored SSH security warnings or used email services that allowed unencrypted connections. The attack targeted users whose traffic exited through one of the 333 compromised nodes.
What was taken
The attackers aimed to steal SSH passwords and observe SSH sessions, including all commands typed. They also tried to capture unencrypted email messages. It is unclear how many users were actually compromised or how much data was taken.
The response
Tor volunteers investigated and partially described the attack, including how the initial compromise happened and how the attackers tried to intercept unencrypted email. The full details, including how all 333 exit nodes were compromised, are still unknown. Tor volunteers recommend only using encrypted email and disabling password authentication for SSH in favour of SSH keys.
What you should do
If you use Tor for SSH or email, always pay attention to host key warnings. Never enter your password if you see a warning that the remote host identification has changed. For email, configure your account to require encrypted connections and reject unencrypted ports. For SSH, disable password authentication and use SSH keys instead. These steps help protect against attacks even if exit nodes are compromised.
Why it matters
This attack shows that even privacy tools like Tor can be undermined if attackers control enough infrastructure. Users who ignore security warnings or use unencrypted services are especially at risk. It highlights the need for strong security habits, even on privacy-focused networks.
Key points
- 333 Tor exit nodes were hijacked to intercept SSH and email traffic.
- Attackers stole SSH passwords from users who ignored security warnings.
- Email connections were forced to downgrade, exposing unencrypted messages.
- The attack lasted three days in October 2026.
- Experts recommend using only encrypted connections and SSH keys.
Sources
Ars Technica
Reference
