Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
- ID
- 37843
- Status
- summarized
- Published
- 21 Oct 2026, 6:30 PM
- Fetched
- 21 Oct 2026, 8:34 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 21 Oct 2026, 8:36 PM
- Tags
- Audience
- developers
What happened
The Hacker News headline states that attackers hijacked more than 300 Tor exit relays in order to intercept SSH connections, published 2026-10-21 under the security category. The body text supplied here is only site navigation and boilerplate, so the article's actual details — campaign timeframe, relay fingerprints or exit-node lists, attribution, and any mitigation advice — are not available in the excerpt. Nothing beyond the 300+ relay count and the SSH interception claim can be confirmed from this text.
Why it matters
The only actionable fact available is the claim that 300+ Tor exit relays were used to intercept SSH traffic; without the article body you cannot tell which relays, which dates, or whether the hijack relied on malicious exit operators or compromised relay hosts, so do not change your SSH-over-Tor practice on this excerpt alone. If your team or tooling routes admin SSH through Tor, the decision to make is whether to pull the full article and cross-check against the Tor Project's exit list before your next session — and to prefer non-Tor transport for privileged access in the meantime if you cannot verify.
Discussion angle
Would you treat Tor as an acceptable transport for privileged SSH access at all — and what specific evidence (relay fingerprints, date range, exit list) would you need before believing a '300+ relays hijacked' claim enough to change your setup?