cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Attackers Hijack Convertr Analytics Script to Skim Payment Data

· Original article ↗

Summary

Sansec reports attackers altered Convertr’s Plausible analytics tracker to inject a checkout skimmer targeting card and CPF data. Sansec suspects, but has not confirmed, CVE-2026-8467 exploitation; Convertr removed the skimmer and patched Plausible.

Key points

  • Sansec says attackers modified a Plausible tracker hosted on Convertr’s infrastructure; the script loaded on checkout pages for merchants using the platform.
  • Sansec suspects attackers exploited CVE-2026-8467, an unauthenticated command-execution flaw in an outdated Plausible Community Edition installation; this has not been confirmed.
  • The skimmer was configured to collect payment card numbers, expiration dates, CVVs, cardholder names and CPF taxpayer identification numbers.
  • By October 26, the skimmer reportedly targeted Convertr’s specific payment API field names.
  • Sansec confirmed Convertr removed the skimmer and upgraded Plausible to a patched version; Convertr announced it was notifying affected merchants and payment providers.
  • Sansec warned browser caching could keep the malicious script active for up to 24 hours after cleanup and advised affected shoppers to contact their bank.

Article Details

Victim Organization
Convertr
Incident Type
Payment-card skimming through malicious code injected into a shared analytics tracker loaded on checkout pages.
Disclosure Date
2026-10-27
Data Types Exposed
  • Payment card number
  • Expiration date
  • CVV code
  • Cardholder name
  • CPF taxpayer identification number
Affected Records
Unknown
Affected Data Size
Unknown
Operational Impact
The skimmer affected checkout pages of merchants using Convertr. Sansec reported that Convertr removed the skimmer and upgraded Plausible to a patched version; browser caching could keep the malicious script active for up to 24 hours after cleanup. Convertr said it was notifying affected merchants and payment providers.
Ransom Or Extortion
Unknown
Claim Status
confirmed

CVE

CVE-2026-8467Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access.

Products

ConvertrHackers hijack Convertr analytics script to steal payment card dataMagentoThe campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.OpenCartThe campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.PlausibleE-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.WooCommerceThe campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.

Industries

E-commerceA credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.FashionConvertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.

Related Articles