The Invisible Proxy: NGINX Hijacked for Silent SEO Poisoning

Datadog research describes an active campaign that compromises NGINX installations and panels (notably Baota) to inject malicious configuration directives which silently proxy user requests to attacker-controlled servers; the operation uses multi-stage shell scripts, targets specific TLDs (e.g., .in, .id, .th) and sectors (education, government), and exfiltrates infection data to a listed C2 IP.