A Brazilian card-skimming group planted code in a script that every Convertr checkout loads, so shoppers’ payment details were sent to the attackers as they paid. Convertr runs the online stores and checkout for dozens of Brazilian fashion brands and says its merchants have sold more than R$2 billion through the platform. According to the security firm Sansec, the attackers changed one file on Convertr’s own server for Plausible, an open-source analytics tool. Every Convertr checkout loads that file, so one change reached all of them.
Sansec first saw the skimmer on 24 October. It reads the card number, expiry date, CVV, cardholder name and the buyer’s CPF (the Brazilian taxpayer number, which banks also use to identify customers) and posts them to a server at 1x0.is. On 26 October the attackers swapped in a version aimed at Convertr’s exact payment fields. Sansec says the same group has been active since at least July 2024, mostly against Magento, OpenCart and WooCommerce stores in Brazil, and that this is the first supply chain attack it has seen from the group. It suspects, but could not confirm, that the attackers got in through CVE-2026-8467, a flaw in Plausible Community Edition 3.0.0 to 3.2.0 that lets anyone run commands on the server; Plausible fixed it in version 3.2.1 in May. Sansec has not seen Convertr’s server logs. On 27 October Convertr removed the skimmer, upgraded Plausible to a patched version and said it was notifying affected merchants, payment providers and the authorities. BleepingComputer’s request for comment had not been answered when it published.
How to check if you’re affected
Affected products are Convertr-powered checkouts in Brazil, and any self-hosted Plausible Community Edition server running versions 3.0.0 through 3.2.0.
- Shoppers: if you paid by card on a Brazilian store since 24 October and the payment page address contained
checkout.convertr, Sansec advises asking your bank to block and replace the card, and watching for fraud that uses your CPF. - Wait out the browser cache: browsers can keep the infected script for up to 24 hours after cleanup, so BleepingComputer, citing Sansec, says to clear your cache before ordering again.
- Merchants on Convertr: ask Convertr to confirm the tracker script on
analytics.convertr.app.bris clean, and tell your payment provider. - Anyone running Plausible CE yourself: upgrade to version 3.2.1 or later and search your access logs for requests to
/storybook. If you find any, Sansec says to rebuild the server, rotate its secrets and compare the files inpriv/tracker/js/with the official release. - BleepingComputer adds that a disposable virtual card, which expires right after one payment, limits what a stolen card number is worth.