Hackers compromise NGINX servers to redirect user traffic

DataDog researchers disclosed a stealthy campaign that compromises NGINX installations and Baota hosting panels to inject malicious configuration 'location' blocks that rewrite and proxy selected URL paths to attacker-controlled domains while preserving headers; a five-stage script toolkit (zx.sh, bt.sh, 4zdh.sh, zdh.sh, ok.sh) performs targeted discovery, safe configuration modification, validation, reloads, and exfiltration to C2 158.94.210.227, primarily targeting Asian TLDs and government/education sites.