Brazilian skimmer gang hijacks Plausible analytics script on Convertr checkouts

A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.

The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.

Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.

E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.

Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible, an open source alternative to Google Analytics, managed by Convertr.

Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.

After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.

Sansec says that earlier versions of the skimmer used generic payment-field patterns, but by October 26, the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.

The injected skimmer was configured to steal the following data types from checkout pages:

The researchers suggest that those who paid by card on a Brazilian store that contained the ‘checkout.convertr’ string in the checkout address page since October 24 should contact their bank immediately and ask to block their card.

In an update today, Sansec confirmed that Convertr "removed the skimmer and upgraded Plausible to a patched version," noting that the company announced it was notifying affected merchants and payment providers.

BleepingComputer has contacted Convertr for a statement on the incident, but we have not received a response yet.

Sansec researchers warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, so customers should clear their cache before placing new orders, even after the threat has been eliminated.

One way to protect payment card details when shopping online is to use disposable virtual cards that expire immediately after a transaction.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

LiteLLM release pipeline hacked to distribute info-stealer malware

WordPress SEO plugin Rank Math compromised to backdoor websites

Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger confirms spy chip implant behind wallet crypto thefts