Security researcher Kaba identified a large-scale cyberattack on the Tor network infrastructure in October 2026. Attackers compromised over 300 exit nodes to intercept SSH traffic and steal credentials. The malicious activity involved redirecting connections to attacker-controlled servers, where passwords were captured and sessions were monitored.
The attackers modified the torrc configuration on compromised Linux hosts to enable port 22 and redirect traffic. In some instances, they also disabled encrypted IMAPS and POP3S ports in favor of unencrypted protocols to intercept email traffic. The scheme targeted password-based authentication by presenting a fake host key to users.
During the attack, the perpetrators attempted to install the Ebury backdoor and infostealer on target systems. Analysis showed that between October 1 and October 4, 2026, 377 nodes linked to 59 operators exhibited suspicious exit policies. At its peak on October 4, these nodes accounted for approximately 7.46% of the network's total exit bandwidth.
The Tor Project began flagging the malicious nodes as BadExit and MiddleOnly on October 4, 2026. By October 5, all compromised nodes were removed from the Tor consensus. Users who connected via SSH through Tor during this period and accepted a new host key are advised to change their credentials and scan their systems for the Ebury malware.
