A credit card skimming group compromised a shared analytics script used by Brazilian e-commerce platform Convertr to steal shoppers’ payment data during checkout, according to e-commerce security firm Sansec. The campaign was identified on October 24 and has been attributed to a Brazilian gang active since at least July 2024.
Sansec reports that the attacker modified a Plausible tracker file hosted on a self-managed server operated by Convertr. The researchers suspect the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, though this has not been confirmed.
After gaining access, the attackers injected malicious code into the Plausible analytics tracker, which loads on the checkout pages of all merchants using the Convertr platform. Earlier versions of the skimmer used generic payment-field patterns, but by October 26 the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.
The injected skimmer was configured to steal payment card numbers, expiration dates, CVV codes, cardholder names, and CPF taxpayer identification numbers. Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370 million) in sales.
Sansec confirmed that Convertr “removed the skimmer and upgraded Plausible to a patched version,” and announced it was notifying affected merchants and payment providers. BleepingComputer contacted Convertr for a statement but did not receive a response.
Sansec warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, and advised customers to clear their cache before placing new orders. Those who paid by card on a Brazilian store with ‘checkout.convertr’ in the checkout page address since October 24 should contact their bank immediately to block their card.
Analysis
Why This Matters
- Shoppers on Brazilian e-commerce stores using Convertr may have had their payment card data stolen, requiring urgent action to block cards.
- The attack exploited a known vulnerability in an outdated analytics installation, highlighting the risks of unpatched third-party software in e-commerce.
- Browser caching can prolong exposure even after the malicious script is removed, meaning affected sites may remain dangerous for up to 24 hours.
Background
Magecart attacks involve injecting malicious code into e-commerce checkout pages to steal payment information. Convertr is a Brazilian e-commerce platform that processes billions of reals in sales for major fashion brands. The gang behind this attack has been active since July 2024, targeting stores running Magento, OpenCart, and WooCommerce.
What to Watch
- Whether Convertr provides further details on affected merchants and the number of compromised transactions.
- Potential follow-up attacks using similar methods against other e-commerce platforms running outdated Plausible Community Edition installations.
- Law enforcement or regulatory action in Brazil given the scale of the breach.
Checked
12 claims in this story checked against 1 source: 9 supported.
Show each claim
- Partly supportedThe headline says a Brazilian skimming gang compromised Convertr’s analytics script and stole payment-card data.BleepingComputer: “A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.”
- Partly supportedThe summary says the attack affects shoppers using Convertr checkout on Brazilian e-commerce stores.BleepingComputer: “After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.”
- SupportedThe campaign was identified on October 24.BleepingComputer: “The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024”
- SupportedThe campaign was attributed to a Brazilian gang active since at least July 2024.BleepingComputer: “The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024”
- SupportedResearchers suspect the attackers exploited CVE-2026-8467, but this has not been confirmed.BleepingComputer: “Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.”
- SupportedThe attacker modified a Plausible tracker file hosted on a self-managed server operated by Convertr.BleepingComputer: “Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.”
- SupportedThe malicious tracker loads on checkout pages of all merchants using Convertr.BleepingComputer: “After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.”
- SupportedBy October 26, the attackers had pushed a version targeting Convertr’s exact payment API field names.BleepingComputer: “Sansec says that earlier versions of the skimmer used generic payment-field patterns, but by October 26, the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.”
- SupportedThe skimmer was configured to steal card numbers, expiration dates, CVVs, cardholder names and CPF taxpayer identification numbers.BleepingComputer: “The injected skimmer was configured to steal the following data types from checkout pages: Payment card number Expiration date CVVs code Cardholder name CPF taxpayer identification number”
- SupportedConvertr powers stores and checkout systems for dozens of major Brazilian fashion brands and handles R$2 billion ($370 million) in sales.BleepingComputer: “Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.”
- SupportedSansec confirmed Convertr “removed the skimmer and upgraded Plausible to a patched version.”BleepingComputer: “In an update today, Sansec confirmed that Convertr "removed the skimmer and upgraded Plausible to a patched version,"”
- Partly supportedSansec announced it was notifying affected merchants and payment providers.BleepingComputer: “noting that the company announced it was notifying affected merchants and payment providers.”
