Researchers at Sansec have documented a credit card skimming operation targeting Convertr, a Brazilian e-commerce platform that processes checkout systems for major fashion retailers. The attackers modified a Plausible analytics tracker—an open source Google Analytics alternative—that was hosted on Convertr's self-managed infrastructure and loaded on the checkout pages of all merchants using the platform.
The incident came to light on October 24 and has been linked to a Brazilian-based threat group that has been active since at least July 2024. This gang specializes in targeting online stores powered by Magento, OpenCart, and WooCommerce. Convertr itself handles approximately R$2 billion ($370M) in annual sales across its network of merchants.
Sansec suspects the attackers leveraged CVE-2026-8467, an unauthenticated command-execution flaw in Convertr's outdated Plausible Community Edition installation, to establish their initial foothold. The vulnerability has not been formally confirmed as the attack vector, though the timing and technical details align with this assessment.
Once inside, the threat actors injected malicious code into the legitimate Plausible analytics tracker. The skimmer evolved rapidly: earlier iterations used generic payment-field detection patterns, but by October 26, attackers deployed a refined version specifically engineered to target Convertr's exact payment API field names.
Data targeted by the skimmer
- Payment card number
- Expiration date
- CVV code
- Cardholder name
- CPF taxpayer identification number
Sansec recommends that anyone who made card purchases on a Brazilian store displaying the 'checkout.convertr' string in the checkout URL since October 24 should immediately contact their bank and request card cancellation.
Convertr has since removed the malicious code and upgraded Plausible to a patched version, according to Sansec's latest update. The platform has begun notifying affected merchants and payment processors of the compromise.
Sansec researchers cautioned that browser caching mechanisms could keep the malicious script active on compromised sites for up to 24 hours following cleanup efforts. Customers are advised to clear their browser cache before completing any new transactions, even after the threat has been remediated.
One protective measure for online shoppers is the use of disposable virtual card numbers that expire immediately upon transaction completion. BleepingComputer reached out to Convertr for additional comment but has not yet received a response.