In early October, attackers gained control of over 300 Tor exit relays, manipulating them to intercept SSH connections. This allowed them to redirect users’ traffic to malicious servers that captured login credentials. The attack specifically targeted SSH logins made through Tor from October 1 to 5, meaning anyone who logged in during that period could have had their password stolen. This incident raises serious concerns about the security of users relying on Tor for anonymity, as it shows how vulnerable even seemingly secure connections can be. Users need to be aware of this threat and consider additional protective measures when accessing sensitive services through Tor.