A Brazilian Magecart group modified an analytics script served by Convertr, a Brazilian e-commerce platform, so that it skimmed payment card data from checkout pages across the platform’s merchants. Security firm Sansec identified the campaign on October 24 and reported it on October 27.
How the Plausible Tracker File Became a Skimmer
Sansec attributes the campaign to a Brazilian gang that has been active since at least July 2024 and focuses on Magento, OpenCart and WooCommerce stores.
The attacker altered the Plausible analytics tracker file on a self-hosted Plausible server run by Convertr. Because that file loads on the checkout pages of all merchants using the platform, a single modification reached every storefront at once.
Suspected Entry Through Plausible Flaw CVE-2026-8467
Sansec suspects, but has not confirmed, that the attacker exploited CVE-2026-8467, an unauthenticated command-execution flaw in Convertr’s outdated Plausible Community Edition. If correct, the entry point was unpatched analytics software rather than the merchants’ own stores.
A Refined Skimmer Aimed at Convertr’s Payment API
By October 26 the attackers had deployed a refined version of the skimmer that targets the exact field names used by Convertr’s payment API. It steals the card number, expiry date, CVV and cardholder name, along with the customer’s CPF taxpayer ID.
Collecting the CPF alongside card details gives the thieves identity data that is useful for fraud beyond a single card transaction.
Scale of the Convertr Platform and Merchant Exposure
Convertr powers checkout for dozens of major Brazilian fashion brands and handles about R$2 billion, roughly $370 million, in sales. The number of victims has not been disclosed, and the number of merchants affected by the modified script has not been itemized beyond the platform-wide loading described by Sansec.
BleepingComputer had not received a statement from Convertr at the time it reported on the case.
Convertr’s Cleanup and the 24-Hour Cache Window
According to Sansec, Convertr removed the skimmer, upgraded Plausible, and is notifying merchants and payment providers. Browser caching could keep the malicious script active for up to 24 hours after the cleanup, so shoppers can remain exposed after the server-side fix.
Sansec said shoppers who paid by card on Brazilian stores with “checkout.convertr” in the checkout URL since October 24 should ask their bank to block the card.
Supply-Chain Skimming Through Third-Party Scripts
The Convertr case follows a pattern in web skimming where attackers go after a shared dependency instead of individual stores. A compromised analytics or checkout script gives access to every site that loads it, which scales the theft without requiring a separate intrusion into each merchant.
The tailoring of the skimmer to Convertr’s own payment API field names suggests the attackers studied the platform’s checkout flow after gaining access. The two-day interval between identification and the refined version shows the group was still adjusting the code while the campaign was running.
Open questions remain about how many cards were captured between October 24 and the cleanup, how long the attacker had access to the Plausible server before the first modification, and whether the suspected CVE-2026-8467 entry point is confirmed. Convertr has not made a public statement addressing those points.
The gang’s stated focus on Magento, OpenCart and WooCommerce stores shows that Convertr is a departure from its usual target type. Instead of compromising stores one at a time, the group reached a shared service. Payment providers are among the parties Convertr is notifying, a step that gives card issuers a chance to monitor cards used on affected stores. The identification on October 24 also sets the start of the exposure window that Sansec gives for shoppers.
