Attackers hijack Convertr analytics script to skim checkout card data
Original title: Hackers hijack Convertr analytics script to steal payment card data
Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.
Sansec says attackers changed a self-hosted Plausible analytics file on Brazilian e-commerce platform Convertr so a card skimmer loaded on merchants’ checkout pages. The campaign was identified on October 24 and attributed to a Brazilian gang active since at least July 2024 that targets Magento, OpenCart and WooCommerce stores. Sansec suspects, but has not confirmed, initial access through CVE-2026-8467. Convertr removed the skimmer, upgraded Plausible and is notifying merchants and payment providers.
Unconfirmed: Sansec suspects CVE-2026-8467 was used for access, but that is unconfirmed, and Convertr has not responded.
- The campaign was identified on October 24; the gang has been active since July 2024.
- Stolen fields included card number, expiration, CVV, cardholder name and CPF.
- By October 26 the skimmer targeted Convertr’s payment API field names.
- Sansec suspects unconfirmed use of CVE-2026-8467 on outdated Plausible Community Edition.
- Cached copies of the script may keep running for up to 24 hours.
Impact: Theft of checkout payment card data and CPF numbers
| Product | Affected |
|---|---|
| Convertr Plausible Community Edition | outdated installation |
- 1.Card payers on pages containing checkout.convertr since October 24 should ask their bank to block the card.
- 2.Clear the browser cache before placing new orders.
- 3.Confirm the skimmer is gone; Convertr says Plausible was upgraded to a patched version.
- CVEs
- CVE-2026-8467
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-8467 | Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in… | 9.5 | <1% |
From the original article
2 min read at bleepingcomputer.com
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.