Follow us on Google News
A Brazilian Magecart group has compromised the checkout infrastructure of ecommerce platform Convertr, injecting a malicious payment skimmer into an analytics script used across multiple online stores and stealing shoppers’ card details and CPF numbers.
The attack was detected on October 24 and affected checkout pages hosted by Convertr, which provides ecommerce infrastructure for dozens of Brazilian fashion brands. The malicious script remained active until October 27, when Convertr removed the skimmer and upgraded its Plausible analytics installation to a patched version.
Security researchers said the incident marked a shift in the group’s tactics because, instead of compromising individual stores one by one, the attackers targeted a shared analytics component used by multiple merchants.
Malicious Code Added to Shared Analytics Script
Convertr operates its own instance of Plausible Community Edition on analytics.convertr.app.br.
All merchants using the platform load a tracker from that server. Attackers modified the tracker file by appending an obfuscated block of malicious JavaScript.
Because the same tracker was embedded across Convertr checkouts, a single compromise was capable of affecting multiple merchant stores at the same time.
The skimmer was designed to activate only on pages containing checkout.convertr.
Once active, it collected information entered into the payment form, including card number, expiry date, CVV, cardholder name and CPF, the Brazilian taxpayer identification number commonly requested during online payments.
The malware also monitored requests sent by the checkout page to its payment API.
When a shopper completed a purchase, the stolen information was encoded and transmitted to the domain 1x0.is.
Researchers observed that the attackers modified the skimmer within two days. The first version used generic payment-field patterns, while a later version was adjusted to target the exact field names used by the Convertr payment API.
Magecart Group Has Targeted Brazilian Stores Since 2024
The group behind the attack has been tracked since July 2024 and has previously infected ecommerce sites running Magento, OpenCart and WooCommerce.
Most of the identified victims have been based in Brazil.
In some earlier cases, compromised stores reportedly remained infected with the group’s payment skimmers for extended periods.
Until the Convertr incident, the attackers were primarily observed compromising individual merchants.
The attack on Convertr represents a supply-chain approach because compromising one shared service allowed malicious code to reach the checkout pages of multiple businesses.
Researchers also linked the operation to a consistent set of infrastructure and coding patterns used in earlier campaigns.
The group has previously used short .is domains and Portuguese-language endpoints for data exfiltration. Some variants have also sent stolen information through Discord webhooks or scripts placed on other compromised websites.
The attackers have developed skimmers targeting Brazilian payment services including e.Rede, PagSeguro, Pagar.me and Mercado Pago. Another known variant has been designed to replace legitimate PIX payment QR codes with QR codes controlled by the attackers.
Outdated Plausible Installation Suspected
Researchers suspect that an outdated Plausible installation may have provided the initial entry point into Convertr’s analytics server.
Convertr had reportedly installed Plausible Community Edition 3.0 in 2025 and had not updated it.
Versions 3.0.0 through 3.2.0 were affected by CVE-2026-8467, a critical vulnerability that could allow unauthenticated attackers to execute commands through a component library exposed at the /storybook path.
Plausible fixed the vulnerability in May 2026 with version 3.2.1.
However, researchers have not confirmed that CVE-2026-8467 was actually used in the Convertr compromise because they did not have access to the company’s server logs.
The possible attack path remains a suspected entry point rather than a confirmed one.
The risk was particularly significant because Plausible serves its tracker directly from a file on the server. If an attacker modifies that file, every website embedding the tracker can potentially receive the malicious code.
Convertr Removes Skimmer and Patches System
The last clean version of the Convertr tracker was observed on October 24 at 05:03 UTC.
The malicious skimmer was detected later that day at 23:22 UTC.
By October 26, the attackers had updated the malware to more closely match Convertr’s payment API, and the compromised tracker was still being served that afternoon.
Convertr later said it had removed the malicious code and upgraded Plausible to a patched version on October 27.
Researchers subsequently confirmed that the tracker on analytics.convertr.app.br was clean.
Convertr also said it was notifying affected merchants, payment providers and relevant authorities.
The company operates checkout services for multiple Brazilian merchants and says businesses using its platform have processed more than R$2 billion in sales.
Cardholders and Merchants Urged to Take Precautions
Customers who entered card details on a Convertr checkout during the affected period may need to treat those credentials as potentially compromised.
Security researchers advised affected shoppers to contact their banks, block or replace exposed cards and monitor for suspicious transactions or misuse involving their CPF.
Merchants using Convertr were advised to confirm that the tracker had been cleaned and to coordinate with their payment providers.
Because browsers can cache JavaScript files, compromised versions of the tracker may also remain temporarily available after the server-side file has been removed.
Organisations running self-hosted Plausible Community Edition were advised to upgrade to version 3.2.1 or later and review server logs for suspicious access to /storybook.
If signs of exploitation are found, affected organisations may need to rebuild the server, rotate credentials and compare tracker files against official release versions.
The Convertr incident highlights the wider danger of supply-chain attacks in ecommerce environments. A single compromised analytics or third-party script can expose payment data across multiple merchants, making timely patching, script integrity monitoring and payment-page security controls critical for platforms handling sensitive customer information.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
