Convertr checkout skimmer exposed shoppers to payment-data theft
Attackers hijacked a shared analytics script used by Brazilian e-commerce platform Convertr, placing malicious code on checkout pages and potentially exposing shoppers’ payment data. The campaign was identified on October 24 and affected stores using Convertr’s checkout infrastructure, making this both a merchant-side compromise and a customer-facing payment risk.
According to the supplied report, the attackers altered a Plausible tracker hosted on a self-managed Convertr server. Plausible is described there as an open-source alternative to Google Analytics. Because the tracker loaded on checkout pages for merchants using the platform, compromising one shared script could extend the skimmer’s reach beyond a single online store.
Sansec suspects that the attackers used CVE-2026-8467, described as an unauthenticated command-execution vulnerability in an outdated Plausible Community Edition installation. That suspected entry point has not been confirmed, so organizations should not treat the CVE attribution as an established finding. The confirmed part of the account is that malicious code was injected into a legitimate tracker hosted on Convertr’s infrastructure.
The campaign also changed over time. Earlier versions reportedly used generic payment-field patterns, while a version pushed by October 26 targeted Convertr’s exact payment API field names. The supplied evidence explicitly lists CPF taxpayer identification numbers among the targeted data types; it does not provide a complete confirmed list of all information taken, so the incident should not be described as a fully quantified card-data breach.
Convertr removed the skimmer and upgraded Plausible to a patched version, and the report says the company announced that it was notifying affected merchants and payment providers. Cleanup may not immediately remove the risk for every visitor: browser caching could keep the malicious script active on impacted sites for up to 24 hours.
People who paid by card on a Brazilian store whose checkout address contained “checkout.convertr” since October 24 should contact their bank immediately and ask to block the card. Before placing another order on an affected site, customers should also clear their browser cache, because cached copies of the malicious script may survive the server-side cleanup window.