A credit card skimming group compromised a shared analytics script used by Brazilian e-commerce platform Convertr, stealing shoppers' payment data during checkout, according to e-commerce security firm Sansec. The campaign was identified on October 24 and has been attributed to a Brazilian gang active since at least July 2024 that targets online stores running Magento, OpenCart, and WooCommerce. Convertr powers online stores and checkout systems for dozens of major fashion brands in Brazil, handling R$2 billion ($370M) in sales.
Sansec says the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr. Plausible is an open source alternative to Google Analytics. Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr's outdated Plausible Community Edition installation, to gain initial access, though that has not been confirmed. After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker on Convertr's infrastructure, which loads on the checkout pages of all merchants using the platform.
Sansec says earlier versions of the skimmer used generic payment-field patterns, but by October 26 the attackers pushed a more refined version that specifically targeted Convertr's exact payment API field names. The injected skimmer was configured to steal data types from checkout pages. The researchers suggest that anyone who paid by card on a Brazilian store whose checkout address page contained the checkout.convertr string since October 24 should contact their bank immediately and ask to block their card.
In an update, Sansec confirmed that Convertr removed the skimmer and upgraded Plausible to a patched version, and that the company announced it was notifying affected merchants and payment providers. BleepingComputer contacted Convertr for a statement on the incident but had not received a response. The incident has no stated US market angle; the affected merchants are Brazilian.
Sansec researchers warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, so customers should clear their cache before placing new orders even after the threat has been eliminated. One way to protect payment card details when shopping online is to use disposable virtual cards that expire immediately after a transaction.
The disclosure follows other recent supply-chain and skimming incidents, including malicious AI agents stealing 600,000 credit cards and infecting more than 100 sites with skimmers, and Ledger asking sellers across Asia to halt sales after a supply-chain attack. Sansec also noted that overall prevention scores can hide what happens after initial access, and that once attackers are using valid credentials, prevention drops sharply, citing the Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments.
More cybersecurity news from TechManNews.
