Hackers hijack Convertr analytics script to steal payment card data

A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.

The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.

Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.

E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.

Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible, an open source alternative to Google Analytics, managed by Convertr.

Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.

After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.

Sansec says that earlier versions of the skimmer used generic payment-field patterns, but by October 26, the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.

The injected skimmer was configured to steal the following data types from checkout pages:

• Payment card number
• Expiration date
• CVVs code
• Cardholder name
• CPF taxpayer identification number

The researchers suggest that those who paid by card on a Brazilian store that contained the ‘checkout.convertr’ string in the checkout address page since October 24 should contact their bank immediately and ask to block their card.

In an update today, Sansec confirmed that Convertr "removed the skimmer and upgraded Plausible to a patched version," noting that the company announced it was notifying affected merchants and payment providers.

BleepingComputer has contacted Convertr for a statement on the incident, but we have not received a response yet.

Sansec researchers warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, so customers should clear their cache before placing new orders, even after the threat has been eliminated.

One way to protect payment card details when shopping online is to use disposable virtual cards that expire immediately after a transaction.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report