Zero Radar
← feed
HighSecurity incidentupdated 25 Oct 2026, 15:20 UTC

Hijacked Tor exit relays stole SSH login passwords

Attackers took over more than 300 relay computers used by the Tor anonymity network. They used them to secretly send some people's remote-login attempts to fake servers that recorded their passwords.

Attacks reported (SecurityWeek, The Hacker News)2 independent sources
SeverityHighSecurity incident
Being exploited?ReportedBy SecurityWeek, The Hacker News, not officially confirmed yet
What to doCheck exposureChange any SSH passwords you entered through Tor between October 1 and 5, 2026, and move to SSH keys.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker hijacks relaysMore than 300 Tor exit relays taken over
  2. 2SSH traffic redirectedConnections sent to attacker servers
  3. 3Passwords capturedLogin credentials recorded during interception
  4. 4Credentials stolenHarvested passwords kept by attacker
  5. ResultAttacker collects SSH passwords

What happened

Attackers took control of more than 300 Tor exit relays in early October 2026 and redirected SSH connections to servers that harvested password logins; the interception appears limited to password-based SSH logins made through Tor between October 1 and 5.

Why it is dangerous: Anyone who logged into an SSH server with a password through Tor during that window could have had the password captured, and system administrators using Tor for SSH are at highest risk.

Are you affected?

You are affected if you used a password to log into an SSH server through Tor between October 1 and 5, 2026.

SSH password logins made through Tor exit relays between October 1 and 5, 2026

What to do

  1. Change any SSH passwords used through Tor between October 1 and 5, 2026
  2. Switch SSH logins to key-based authentication instead of passwords
  3. Check whether any SSH servers you access were reached via Tor during that window and review their logs

Timeline

  1. 21 Oct 2026, 10:30 UTC
    Publicly disclosed
  2. 23 Oct 2026, 14:23 UTC
    Reported by SecurityWeek · SecurityWeek
  3. 25 Oct 2026, 15:20 UTC
    The Hacker News reported on it · The Hacker News

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-52d32329 · ZR-00d9c6c0
Disclosed
21 Oct 2026, 10:30 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Hijacked Tor exit relays stole SSH login passwords · Zero Radar