Magecart skimmer hits Convertr checkouts through Plausible tracker
Original title: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics
Sansec says the tracker was still serving the skimmer on October 26 and that card data plus CPF was posted to 1x0.is.
Sansec says a Brazilian Magecart group it has tracked since July 2024 appended a skimmer to Convertr's Plausible analytics file, so every Convertr checkout loaded it. The script activates on checkout.convertr pages, reads card number, expiry, CVV, name and CPF, and posts them to 1x0.is. Sansec notified Convertr and got no response; on October 26 Convertr was still serving the skimmer. Plausible CE 3.0.0 through 3.2.0 has CVE-2026-8467, fixed in 3.2.1, but Sansec cannot confirm that was the entry point.
Unconfirmed: Sansec suspects CVE-2026-8467 but says it has not seen Convertr logs and cannot confirm the entry point.
- Last clean tracker copy was October 24 at 05:03 UTC; skimmer found that night.
- A second build on October 26 targeted Convertr payment API field names.
- Plausible fixed CVE-2026-8467 in CE 3.2.1 on May 15, 2026.
- Browsers may cache the infected script for up to 24 hours after cleanup.
Impact: Card data, CVV, name and CPF stolen at checkout
| Product | Affected | Fixed in |
|---|---|---|
| Plausible Community Edition | 3.0.0 through 3.2.0 | 3.2.1 |
| Convertr analytics tracker script | — | — |
- 1.If you paid on a checkout.convertr page since October 24, ask your bank to replace the card.
- 2.Ask Convertr to confirm the tracker is clean and tell your payment provider.
- 3.Upgrade self-hosted Plausible CE to 3.2.1 or later and check logs for /storybook.
- CVEs
- CVE-2026-8467
- Vendors
- Plausible
- Products
- Plausible Community Edition
- Threat actors
- Brazilian Magecart group
- Victims
- Convertr
- Organizations
- Sansec
- Countries
- Brazil
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-8467 | Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in… | 9.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | antiddos-protection.net | eqp.is shy.is blz.is tray.is miorl.net xwv.is fasthook.app antiddos-protection.net # Discord webhooks used for exfiltration, by webhook ID dis |
| domain | deepveindrilling.com | elKit vulnerability threatens 40,000+ WooCommerce checkouts deepveindrilling.com: Magento CMS block loader hits 953 stores Brevo supply chai |
| domain | fasthook.app | l.is xsox.diy eqp.is shy.is blz.is tray.is miorl.net xwv.is fasthook.app antiddos-protection.net # Discord webhooks used for exfiltr |
| domain | kof.one | xfiltration domains of the same group snf.is kk.land nmn.is kof.one anl.is xsox.diy eqp.is shy.is blz.is tray.is miorl.net xwv. |
| sha256 | ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 | s.convertr.app.br/js/script.pageview-props.tagged-events.js ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 # Skimmer strings indexOf('checkout.convertr') _s+=String.f |
From the original article
4 min read at sansec.io
Convertr runs the online stores and checkout of dozens of Brazilian fashion brands. All of them load a tracker from analytics. convertr.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.