---
title: Attackers turned 300+ Tor exit relays into SSH password stealers with Ebury; Tor flagged them BadExit by Oct 5 | ctxsec
url: https://ctxsec.com/items/tor-exit-ebury-ssh-mitm-oct-2026
description: ""
status: "confirmed (researcher analysis + Tor Project BadExit action; Oct 1–5 window)"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/tor-exit-ebury-ssh-mitm-oct-2026.md)

confirmed (researcher analysis + Tor Project BadExit action; Oct 1–5 window)

2026-10-21

### Attackers turned 300+ Tor exit relays into SSH password stealers with Ebury; Tor flagged them BadExit by Oct 5

Researcher **kaba** reports that from Oct 2, about **333 Tor exit relays** (roughly 10% of exits; directory analysis cites up to 377 relays / 59 operators matching the exit policy) redirected SSH (port 22) to a set of ~12 interception servers. Victims who ignored the host-key-changed warning had passwords stolen, sessions MITMed, and hosts infected with **Ebury 1.8.3** (OpenSSH backdoor). Attackers had rooted many hosts earlier (August), then edited `torrc` to enable exit-to-22. Peak consensus weight for the attacker exit policy was about **7.46%** of exit capacity on Oct 4. Tor Network Health began notifying operators and marking relays BadExit Oct 4; by Oct 5 infected exits were out of the consensus as exits. Only password logins over Tor during Oct 1–5 that accepted the fake host key were at risk for credential theft via this path. **Do now:** if you SSHed over Tor in that window and accepted a new host key, rotate credentials and check for Ebury; prefer key-only auth and never ignore host-key warnings.

Sources: [kaba: How I got over 300 Tor exit nodes removed](https://kaba.cx/posts/20261020_Tor/) · [tor-relays: Ebury 1.8.3 on Quetzalcoatl relays (operator writeup)](https://lists.torproject.org/mailman3/hyperkitty/list/tor-relays@lists.torproject.org/thread/QHRD6YOX6RZRDR7NCHNDO7GLCEA6VFM6/) · [The Hacker News](https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html)