Finding
A traffic-analytics script became a payment-data breach. E-commerce security firm Sansec says attackers appended an obfuscated card skimmer to a Plausible analytics file hosted on Brazilian commerce platform Convertr’s own server. Every Convertr checkout loaded that shared file, so one server-side modification put the malicious code into shoppers’ browsers across dozens of fashion merchants.
The skimmer activated on Convertr checkout pages and read card numbers, expiration dates, CVV codes, cardholder names and Brazilian CPF taxpayer identifiers from payment forms and checkout API traffic. When a shopper placed an order, the script sent the captured fields to an attacker-controlled domain. The checkout itself could still succeed, leaving no obvious failure for the shopper and potentially little evidence in each merchant’s application logs.
Sansec says Convertr’s merchants have processed more than R$2 billion in sales, but that figure is context, not an incident-loss estimate. No public source reviewed for this draft provides a verified count of exposed shoppers, cards, merchants or fraudulent transactions.
Timeline
Sansec’s last observed clean copy of the tracker was at 05:03 UTC on October 24. It detected the skimmer at 23:22 UTC that day. By October 26, the attacker had replaced the first generic version with code tailored to the exact field names used by Convertr’s payment API. Sansec reported that the infected file was still being served at 15:34 UTC on October 26.
On October 27, Sansec reported that Convertr had removed the skimmer, upgraded its Plausible installation and begun notifying merchants, payment providers and authorities. The researchers confirmed the tracker was clean shortly afterward. They also warned that browser caches could retain the infected script for up to 24 hours after the server copy was replaced.
The initial access path remains unproven. Sansec suspects exploitation of CVE-2026-8467 in an outdated Plausible Community Edition installation, but it did not have Convertr’s server logs and explicitly could not confirm that route. The attribution to a Brazil-focused Magecart group is also Sansec’s assessment based on observed code and infrastructure patterns, not a public law-enforcement finding.
Lessons
A script does not need to process payments to become part of the payment security boundary. If analytics, tag-management, support or marketing JavaScript runs on a checkout page, it can read the same browser fields and network requests as the legitimate application. Teams should inventory every executable resource on sensitive pages and ask what it could see after compromise.
Shared JavaScript creates platform-scale concentration. Merchant websites may have remained individually uncompromised while a single file from their commerce provider distributed the skimmer to all of them. Content Security Policy, subresource integrity where feasible, short-lived and reviewable builds, script-drift monitoring and an emergency revocation path can reduce that shared exposure.
Browser-side incidents need browser-side detection. A successful order and clean merchant server logs do not prove that payment data stayed private. Synthetic checkout monitoring should inspect the actual scripts loaded, their hashes and their outbound destinations. Recovery should include cache behavior, customer notification criteria, payment-provider coordination and a way to identify the exact exposure window.
What remains uncertain
Convertr has not published a directly accessible public incident statement. Cleanup, patching and notification claims come through Sansec’s update and subsequent reporting. The suspected CVE-2026-8467 entry route is unconfirmed. No verified count of affected shoppers, cards, merchants, exfiltrated records or fraudulent transactions is public. Sansec’s attacker attribution is preliminary.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics · Original source · 2026-10-26
- Hackers hijack Convertr analytics script to steal payment card data · Reporting · 2026-10-27
- Supply chain attack compromises Convertr e-commerce platform · Reporting · 2026-10-28