Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed host keys.