A Brazilian card-skimming gang edited one shared Plausible analytics file and turned it into a Convertr checkout skimmer that ran on every merchant's payment page. If your checkout loads scripts from a server you don't control, list them today and find out who patches that server.
Key takeaways
- Sansec found a skimmer in Convertr's shared Plausible tracker on October 24; it ran on every merchant checkout.
- It took card number, expiry, CVV, cardholder name and CPF, retuned to Convertr's API field names by October 26.
- Convertr removed it and patched Plausible; cached copies can run up to 24 hours.
What did the Convertr checkout skimmer actually do?
It stole payment data from every Convertr checkout by hiding inside an analytics script those checkouts trusted. Sansec, an e-commerce security firm, spotted it on October 24 in a modified file from Plausible, the open-source Google Analytics alternative Convertr hosted itself.
Convertr runs storefronts and checkouts for dozens of major Brazilian fashion brands and handles roughly R$2 billion (about $370 million) in sales.
The skimmer captured card number, expiry date, CVV, cardholder name and CPF, Brazil’s taxpayer ID. Early generic builds gave way by October 26 to one keyed to Convertr’s exact payment API field names, a sign the operators had studied the target.
CPF plus card data enables identity fraud and sharper phishing. CPF is personal data under Brazil’s LGPD, so merchants may face notification questions involving the ANPD.
Why did one Plausible file reach every payment page?
One copy of the tracker, served from Convertr’s systems, was embedded in every tenant’s checkout, so one edit reached every store.
Sansec suspects the way in was CVE-2026-8467, an unauthenticated command-execution flaw in the outdated Plausible Community Edition Convertr ran, but stresses this is unconfirmed. It attributes the campaign to a Brazilian group active since at least July 2024 that hits Magento, OpenCart and WooCommerce stores. Outdated self-hosted software is what such crews scan for, as we explain in how attackers find exposed websites.
Why didn't standard checkout defenses catch it?
Because the code came from a source every checkout trusted.
- HTTPS protects the script in transit, not against a trusted host serving malicious content.
- A Content Security Policy that allowlists the analytics domain still accepts the edited file.
- Subresource Integrity would reject it, but pinning hashes is impractical for frequently updated analytics.
What has been fixed, and what is still unknown?
Sansec later confirmed Convertr removed the skimmer, upgraded Plausible to a patched version and began notifying merchants and payment providers.
Cached copies can keep running in browsers for up to 24 hours, so Sansec advises clearing the cache before ordering again. Anyone who paid by card on a “checkout.convertr” address since October 24 should call their bank and block the card. October 24 is when Sansec spotted the skimmer, not necessarily when it went live.
What should a store owner decide now?
A clean server scan does not clear a checkout: the skimming code can live on someone else’s server and run only in the shopper’s browser. The script-inventory and change-detection requirements added in PCI DSS 4.0 exist for exactly this case.
- Inventory checkout scripts, including your own analytics, and remove what the payment step doesn’t need.
- Patch self-hosted analytics like production software.
- Test the live payment flow with test card data and developer tools open; skimmers may fire only on keystroke or submit.
- Get answers in writing from your platform: exposure window, fields taken and a change log for shared assets.
File-change monitoring, such as our antivirus website protection, covers the server side.
FAQ
Was CVE-2026-8467 confirmed as the way into Convertr's server?
No. Sansec suspects the flaw in Convertr's outdated Plausible but has not confirmed it.
How do I know if my card was exposed on checkout.convertr?
If you paid by card on a "checkout.convertr" address since October 24, call your bank and block the card.
Are stores that don't use Convertr at risk?
Yes. The same group has hit Magento, OpenCart and WooCommerce stores since at least July 2024.
Not sure what loads on your checkout? We can check and monitor it. See our website protection packages.