Brazilian Hackers Compromise Convertr Analytics Script, Stealing Payment Card Data from E‑Commerce Stores

Incident Overview

A credit‑card skimming operation compromised a shared analytics script used by the Brazilian e‑commerce platform Convertr. The malicious activity, first detected on October 24, allowed attackers to harvest shoppers’ payment information during the checkout process on dozens of fashion‑brand stores powered by Convertr. The group, linked to a Brazilian criminal network active since at least July 2024, targets online shops running Magento, OpenCart, and WooCommerce platforms.

How the Attack Worked

Security researchers at Sansec reported that the intruders modified a Plausible tracker file hosted on a self‑managed server operated by Convertr. Plausible is an open‑source analytics alternative to Google Analytics. The attackers are suspected of exploiting an unauthenticated command‑execution vulnerability, identified as CVE‑2026‑8467, affecting Convertr’s outdated Plausible Community Edition installation, though this has not been definitively confirmed.

Once inside, the hackers injected malicious JavaScript into the legitimate Plausible tracker. This script loads on the checkout pages of every merchant using Convertr’s infrastructure, enabling the skimmer to capture card details in real time. Early versions of the skimmer used generic field patterns, but by October 26 the attackers refined the code to target Convertr’s exact payment API field names, increasing the precision of data theft.

Impact on Users

The injected skimmer was configured to steal the following data types from checkout pages:

• Cardholder name
• Card number
• Expiration date
• CVV/CVC code

Any customer who made a card purchase on a Brazilian store containing the ‘checkout.convertr’ string in the page URL between October 24 and the cleanup date may have had their payment data compromised. Affected shoppers are advised to contact their bank immediately, request a card block, and monitor for unauthorized transactions.

Response and Remediation

Convertr has removed the malicious script and upgraded its Plausible installation to a patched version. The company announced it is notifying affected merchants and payment providers. Sansec researchers caution that browser caching can keep the malicious script active for up to 24 hours after the fix, so users should clear their cache before placing new orders.

Practical Implications and Protection Steps

• Virtual Cards: Using disposable virtual card numbers can limit exposure, as these numbers expire immediately after a transaction and cannot be reused.
• Cache Management: Clearing browser cache after a site security update helps ensure that any lingering malicious scripts are not executed.
• Regular Updates: Keeping e‑commerce platforms and analytics tools patched reduces the risk of unauthenticated command‑execution vulnerabilities.
• Monitoring: Merchants should monitor checkout pages for unexpected script tags and employ security solutions that detect anomalous JavaScript injections.

What’s Confirmed and What Remains Unknown

Confirmed

• A Brazilian hacking group has compromised Convertr’s Plausible tracker.
• The attackers injected a payment‑card skimmer that loads on Convertr‑powered checkout pages.
• Convertr has removed the skimmer and upgraded Plausible to a patched version.
• The vulnerability CVE‑2026‑8467 is suspected but not yet verified as the initial entry point.

Unknown

• The exact number of compromised transactions or cards.
• Whether the attackers obtained any additional data beyond the targeted payment fields.
• The full scope of other Convertr‑hosted services that might have been affected.

How to Verify the Information

Readers can review the original incident report on Bleeping Computer, which includes technical details and statements from Sansec: https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/. The source also links to Convertr’s security advisory (if issued) and provides guidance for merchants on remediation steps.

Keywords

Convertr, payment card theft, e‑commerce security, Magento, OpenCart, WooCommerce, Plausible, CVE‑2026-8467, Brazilian hackers, card skimmer, Sansec, virtual cards, browser cache, security remediation.