Researcher kaba found 333 Tor exits redirecting SSH to 12 interception servers on Oct 2, 2026. Tor Project flagged relays Oct 4; removed from consensus by Oct 5. Peak attack exit capacity ~7.46% by consensus weight. Password capture required SSH-over-Tor with accepted changed host keys Oct 1-5.