333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Unknown attackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through attacker-controlled infrastructure, per Ars Technica. Exit-node operators and users relying on Tor for sensitive traffic are exposed to credential theft and interception. Why it matters: it is one of the largest documented exit-node hijacking campaigns, striking at the trust model of anonymity networks.

• Ars Technica2026-10-22 11:30