Hackers Compromise Shared Analytics Script on E-commerce Platform Convertr to Steal Card Data

Analytics Script Hijacked on Brazilian E-commerce Platform

A credit card skimming group has compromised a shared analytics script utilized by the Brazilian e-commerce platform Convertr, enabling the unauthorized extraction of shoppers' payment details during online checkout. Identified on October 24, the campaign has been attributed by cybersecurity researchers to a Brazilian threat actor active since at least July 2024 that typically targets online stores operating on Magento, OpenCart, and WooCommerce.

Convertr provides infrastructure for online stores and checkout systems for numerous major fashion brands throughout Brazil, processing roughly R$2 billion, equivalent to about $370 million, in annual sales.

Attack Vector and Malicious Code Injection

According to findings published by e-commerce security firm Sansec, the attackers modified a legitimate Plausible tracker file—an open-source analytics alternative hosted on a self-managed server operated by Convertr. Sansec researchers suspect that the threat actors may have exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr's outdated installation of the Plausible Community Edition, to obtain initial access, though this specific vector remains unconfirmed.

Once inside the infrastructure, the attackers injected malicious code into the analytics tracker file, which automatically loads on the checkout pages of all merchants utilizing the Convertr platform. Initial iterations of the script utilized generic payment-field patterns, but by October 26, the operators deployed a refined version specifically tailored to target Convertr's exact payment API field names.

Remediation and Response

In subsequent updates, Sansec confirmed that Convertr removed the malicious skimmer, updated its Plausible analytics software to a patched version, and began notifying impacted merchants and payment processors. Independent media attempts to reach Convertr for official statements have not yet yielded a response.

Security experts note that browser caching may allow the malicious script to persist on affected user devices for up to 24 hours following remediation efforts. Consequently, researchers advise customers to clear their browser cache before conducting new transactions.

Practical Implications and Reader Verification

• Impacted Users: Individuals who completed card payments on Brazilian online storefronts featuring the string `checkout.convertr` in the checkout page address since October 24 are advised to contact their financial institutions immediately to request card blocking.
• Mitigation Strategies: Using disposable virtual cards that expire immediately after a single transaction can help safeguard primary payment details during online purchases.
• What is Confirmed vs. Unknown: Security researchers have confirmed the script modification, the deployment of refined API-targeted skimming code, and the subsequent software patch applied by Convertr. The exact initial exploitation method (such as CVE-2026-8467) remains suspected but unconfirmed.
• How to Verify: Readers can review the original technical analysis and ongoing updates directly on the [BleepingComputer Report](https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/).