Threat Actors Exploit React2Shell Vulnerability to Hijack NGINX Web Traffic Researchers at Datadog Security Labs have uncovered a multi-stage, automated campaign where threat actors exploit the React2Shell vulnerability to compromise NGINX web servers, redirecting traffic for malicious purposes. The attacks primarily target organizations in Asia particularly those with domains ending in .in, .id, .pe, .bd, .edu, .gov, and .th as well as Chinese hosting infrastructure, often running Boato Panel for server management. Once inside a network, attackers deploy toolkits containing scripts for target discovery, persistence, and malicious configuration file creation. These files manipulate NGINX’s routing rules to hijack web traffic, enabling activities such as: - Fingerprinting organizational traffic - Injecting malware into users’ devices - Redirecting visitors to phishing pages to steal credentials The shift toward NGINX exploitation reflects a broader trend: as defenses like MFA and password managers strengthen, attackers are reverting to infrastructure-level attacks such as session cookie theft to bypass modern security controls. Notably, two IP addresses now account for 56% of observed exploitation attempts, a sharp consolidation from over 1,000 unique sources earlier. Defensive measures highlighted by researchers include: - Monitoring NGINX configuration file integrity to detect unauthorized changes - Applying the latest security patches, particularly for React and NGINX - Locking down configuration files to prevent tampering The attacks underscore the risks of unpatched vulnerabilities and poorly secured web infrastructure, with compromised sites facing reputational damage if flagged for hosting malware. The use of AI-driven exploitation tools further lowers the barrier for attackers, making server-side vulnerabilities a fast and cost-effective target.