Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Convertr removes Magecart skimmer from its Plausible tracker

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Convertr has removed a Brazilian Magecart skimmer from its Plausible analytics script and is notifying merchants.

Sansec says a Brazilian Magecart group tracked since July 2024 altered Convertr’s self-hosted Plausible analytics file so merchant checkouts loaded a card skimmer. The script ran on checkout.convertr pages, collected card number, expiry, CVV, name and CPF, and posted them to 1x0.is. A clean copy was last seen on October 24; a second build on October 26 targeted Convertr payment API field names. Sansec suspects but has not confirmed entry through CVE-2026-8467 in Plausible Community Edition 3.0.0 through 3.2.0, fixed in 3.2.1 on May 15. BleepingComputer reports Convertr later removed the skimmer, upgraded Plausible and is notifying merchants and payment providers. Cached copies may persist for up to 24 hours.

Key facts
  • Gang tracked since July 2024 also targets Magento, OpenCart and WooCommerce.
  • Skimmer posted card data and CPF to 1x0.is, according to Sansec.
  • Last clean tracker copy was October 24 at 05:03 UTC.
  • CVE-2026-8467 affects Plausible CE 3.0.0–3.2.0; fixed in 3.2.1.
  • Use of that flaw for entry is suspected but unconfirmed.
  • Browsers may cache the infected script for up to 24 hours.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 15, 2026Plausible fixed CVE-2026-8467 in Community Edition 3.2.1. · Sansec
  2. Oct 24, 2026Last clean tracker seen; skimmer found that night. · Sansec
  3. Oct 26, 2026Second build still served; Convertr had not replied. · Sansec
  4. Oct 27, 2026Convertr removed the skimmer and upgraded Plausible. · BleepingComputer

What each outlet adds

beyond the shared facts
  • SansecExfil domain, exact timestamps, CVE fix date and no reply.
  • BleepingComputerRemoval, upgrade, and merchant and payment-provider notifications.
CVEs
CVE-2026-8467
Vendors
PlausibleConvertr
Products
Plausible Community EditionPlausibleMagentoOpenCartWooCommerce
Threat actors
Brazilian Magecart groupMagecart
Victims
Convertr
Organizations
Sansec
Countries
Brazil

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Sansec (Magento / e-commerce security)First report

    Magecart skimmer hits Convertr checkouts through Plausible tracker

    Sansec says the tracker was still serving the skimmer on October 26 and that card data plus CPF was posted to 1x0.is.

  2. · 3d ago BleepingComputer

    Attackers hijack Convertr analytics script to skim checkout card data

    Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-8467
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in…
9.5<1%