Malware · Application Security
Hackers hijack Convertr analytics script to steal shoppers’ card data
A Brazilian e-commerce platform’s analytics script was hijacked to skim payment card details from online shoppers. The attack hit dozens of fashion brands before being removed.
Ross Grant2 min read
The short version
Hackers broke into a script used by a Brazilian online shopping platform and used it to steal credit card details from people making purchases. The attack affected many fashion brands’ websites. The company has since removed the malicious code, but shoppers who used their cards on these sites should check their statements and consider blocking their cards. Clearing your browser cache can help remove any leftover malicious code.
By the numbers
- R$2 billionannual sales handled by Convertr platformBleepingComputer
- 24 October 2026date the attack was discoveredBleepingComputer
What happened?
Hackers compromised an analytics script used by Brazilian e-commerce platform Convertr to steal payment card data from shoppers. The attack was discovered on 24 October and affected dozens of major fashion brands’ online stores. Convertr has since removed the malicious code and updated its systems. The company is notifying affected merchants and payment providers.
Who is affected
The attack targeted online stores using Convertr, a Brazilian e-commerce platform that supports checkout systems for dozens of major fashion brands in Brazil. Any shopper who paid by card on a Brazilian store with a checkout page containing the ‘checkout.convertr’ address since 24 October may have been exposed, according to Sansec (opens in a new tab).
What was taken
The attackers injected a skimmer into a legitimate analytics script. This malicious code captured payment card data entered by customers during checkout. Sansec reports that the skimmer evolved over several days: early versions looked for generic payment fields, but by 26 October it was targeting Convertr’s specific payment API field names, making the theft more precise.
How the attack worked
Researchers believe the attackers exploited CVE-2026-8467, a command-execution vulnerability in an outdated version of Plausible Community Edition, an open-source analytics tool hosted by Convertr. This allowed them to modify the Plausible tracker file on Convertr’s infrastructure. The compromised script was loaded on the checkout pages of all merchants using Convertr, letting the attackers steal card data from every transaction processed through the affected sites. Sansec attributes the attack to a Brazilian group active since July 2024, known for targeting Magento, OpenCart, and WooCommerce stores. However, the exact method of initial access has not been confirmed.
The response
Convertr removed the malicious script and upgraded Plausible to a patched version after being notified. The company is notifying affected merchants and payment providers. Sansec warns that browser caching could keep the malicious script active on some sites for up to 24 hours after cleanup, so customers are advised to clear their browser cache before making new purchases. Shoppers who paid by card on affected sites since 24 October should contact their bank and consider blocking their card. Using disposable virtual cards for online purchases can also reduce risk.
What you should do
If you shopped on a Brazilian fashion site using Convertr’s checkout since 24 October, check your card statements for unauthorised charges. Contact your bank to block your card if you see anything suspicious. Clear your browser cache before making further purchases on these sites, as cached scripts could still be active for a short time. Merchants should update all analytics and third-party scripts promptly and monitor for unauthorised changes.
Claimed vs confirmed
- Unconfirmed
Attackers exploited CVE-2026-8467 to gain access.
Sansec suspects this was the method, but it has not been confirmed.
- Unconfirmed
A Brazilian group is behind the attack.
Sansec attributes the attack to a Brazilian gang active since July 2024, but this is not confirmed by authorities.
Why it matters
This attack shows how a single compromised script can put thousands of shoppers at risk, even on trusted brand websites. It highlights the importance of keeping third-party tools up to date and monitoring for unauthorised changes.
Key points
- A shared analytics script on Convertr was hijacked to steal card data.
- Dozens of Brazilian fashion brands’ online stores were affected.
- Attackers used a vulnerability in an outdated analytics tool to gain access.
- Convertr removed the malicious code and notified merchants.
- Shoppers should check statements and clear browser cache if affected.
Sources
BleepingComputer
Reference
