Summary
A credit-card skimming group compromised a shared analytics script used by the Brazilian e-commerce platform Convertr, according to security firm Sansec as reported by BleepingComputer. The attackers modified a Plausible analytics tracker file on a self-managed Convertr server. That tracker loads on the checkout pages of every Convertr merchant, so one change reached many stores at once.
Convertr serves major fashion brands and handles roughly R$2 billion (about $370M) in sales.
Timeline
- October 24, 2026 — Sansec identifies the campaign.
- October 26, 2026 — Attackers deploy a more refined skimmer that targets Convertr's exact payment field names.
- Convertr has since removed the skimmer and upgraded Plausible, and says it is notifying affected merchants and payment providers.
Technical Details
The skimming group is Brazilian, has been active since at least July 2024, and targets stores running Magento, OpenCart, and WooCommerce. Sansec suspects initial access came through CVE-2026-8467, an unauthenticated command-execution flaw in an outdated Plausible Community Edition install. This has not been confirmed.
The skimmer collected:
- Card numbers and expiration dates
- CVV codes
- Cardholder names
- CPF taxpayer numbers
Impact
Shoppers who paid by card on affected Convertr-powered stores since October 24 are at risk. Because cached scripts can persist in browsers for up to 24 hours after cleanup, exposure may continue briefly after the server-side fix.
Recommendations
Shoppers
- Contact your bank to block or replace any card used on affected stores.
- Clear the browser cache before placing new orders.
- Consider disposable virtual cards for online purchases.
Merchants and platform operators
- Inventory every third-party script on checkout pages and apply Subresource Integrity (SRI) or self-host where possible.
- Patch self-hosted analytics software promptly, and do not expose it unauthenticated to the internet.
- Deploy a strict Content Security Policy and monitor checkout pages for unexpected script changes.