The Tor network uses relays to provide anonymity, but exit nodes have been identified as targets for malicious traffic redirection. Researchers have documented instances where compromised relays were used to intercept unencrypted communications.
Risks of Tor Exit Node Interception
The Tor network functions by routing traffic through multiple relays, with the final relay—the exit node—removing the final Tor encryption layer and sending the traffic to the destination. If an exit node is compromised, it can observe or manipulate traffic that is not protected by end-to-end encryption. Reports have identified campaigns where attackers hijacked hundreds of exit relays to redirect SSH traffic toward unauthorized servers. In these scenarios, users attempting to connect via SSH might be redirected to an interceptor server, potentially exposing credentials if they ignore host key warnings.
Historical Traffic Manipulation
Beyond SSH redirection, malicious relay operators have previously targeted unencrypted email and web traffic. In 2020, the Tor Project identified groups of relays that were configured to prevent users from upgrading to HTTPS connections. By preventing an HTTP connection from being redirected to HTTPS, attackers aimed to capture sensitive information from users who did not notice the absence of security indicators in their browsers. These relays were removed from the network upon discovery to mitigate further risks.
Security Best Practices
To protect against interception at the exit node, users and administrators are encouraged to maintain strict security protocols. For SSH, users should always verify host fingerprints and avoid ignoring security warnings. For web traffic, the use of HTTPS is essential to ensure that data remains encrypted even if an exit node is malicious. Furthermore, website administrators are encouraged to deploy onion services, which allow users to access websites without ever leaving the Tor network, thereby bypassing exit nodes entirely.
Sources and further reading
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email - Ars Technica
https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
Tor security advisory: exit relays running sslstrip in May and June 2020 | The Tor Project
https://blog.torproject.org/bad-exit-relays-may-june-2020/