Attackers hijacked over 300 Tor exit relays in early October, rewriting their exit policies to allow SSH traffic and redirecting connections to interception servers that captured passwords. The Tor Project began flagging the relays on October 4, and by October 5 none remained in the consensus, the list of relays Tor clients use.
The attack worked only for password-based SSH logins. When a user connected through a hijacked exit, the interceptor presented its own host key; if the user accepted it and typed a password, the password was stolen. Key-based logins were safe because the client's signature is tied to the session and could not be replayed against the real server.
Researcher kaba found 333 exits redirecting SSH to 12 servers. Directory data counted 377 relays with a matching policy change, but the analysis notes that is "a policy match, not proof of compromise." The Tor Project's network health team said attackers appeared to gain access to Linux hosts and edit torrc files to turn them into exits.
Users who connected to SSH over Tor between October 1 and the afternoon of October 5 and accepted a changed or unfamiliar host key should treat their password as stolen, change it, and check for signs of the Ebury backdoor. No victim count exists.