A payment card skimming campaign has compromised a shared analytics script used by Brazilian e-commerce platform Convertr, potentially exposing shoppers’ card details and other personal information during checkout. The activity, identified on October 24, is reportedly linked to a Brazilian cybercrime group that has targeted Magento, OpenCart and WooCommerce stores since at least July 2024.
Convertr provides e-commerce and checkout services for dozens of major Brazilian fashion brands and processes sales worth R$2 billion ($370 million).
Attackers tampered with a shared analytics script
According to e-commerce security firm Sansec, attackers modified Plausible tracker files hosted on self-managed servers operated by Convertr. Plausible is an open-source alternative to Google Analytics that Convertr manages and deploys across its infrastructure.
Sansec believes the attackers may have exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting older Plausible Community Edition installations used by Convertr. However, the suspected exploitation has not been confirmed.
After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure. Because the tracker was loaded on the checkout pages of sellers using the platform, the injected skimmer could target payment information across multiple online stores.
Source: Sansec
Skimmer targeted Convertr payment fields
Sansec said earlier versions of the skimmer searched for common payment-field patterns. By October 26, however, the attackers had deployed a more advanced version designed to identify Convertr’s exact payment API field names.
The malicious script was configured to collect:
- Payment card numbers
- Expiration dates
- CVV codes
- Cardholder names
- CPF taxpayer identification numbers
Sansec recommends that anyone who made a card payment at a Brazilian store with a checkout address containing the string checkout.convertr since October 24 contact their bank immediately and ask for the card to be blocked.
Convertr removes the skimmer
In an update, Sansec confirmed that Convertr had “removed the skimmer and upgraded Plausible to a patched version.” The company also said it would notify affected merchants and payment providers.
BleepingComputer contacted Convertr for a statement about the incident but had not received a response at the time of publication.
Sansec researchers warned that browser caches can keep malicious scripts active on affected sites for up to 24 hours after cleanup. Customers should therefore clear their browser caches before placing new orders, even after the threat has been removed.
How shoppers can reduce payment risks
One way to limit exposure when shopping online is to use a disposable virtual card that expires immediately after the transaction. Customers who may have entered payment details on an affected checkout page should also monitor their accounts and follow their bank’s guidance.
Security defenses can weaken significantly after an attacker gains access using valid credentials.
The Blue Report 2026 measures defense techniques across technologies using 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com