A Brazil-focused Magecart group planted a payment card skimmer inside the analytics script that Brazilian e-commerce platform Convertr loads on its checkout pages, according to e-commerce security firm Sansec. The researchers say the malicious code ran from October 24 to October 27, 2026, and was built to capture card numbers, expiry dates, CVV codes, cardholder names and CPF taxpayer numbers. Convertr disputes that any of its stores were affected.
Convertr runs the online stores and checkout systems of dozens of Brazilian fashion brands. The company says its merchants have sold more than R$2 billion (about €320 million) through the platform. No list of affected stores or count of exposed shoppers has been published.
One tracker file served every Convertr checkout
Convertr hosts its own copy of Plausible, an open source alternative to Google Analytics, on a self-managed server at analytics.convertr.app.br. Every Convertr checkout loads a tracker file from that server, script.pageview-props.tagged-events.js. A single change to that file reached every checkout on the platform.
Sansec says the attacker left the stock Plausible tracker in place and appended an obfuscated block of character codes. At runtime, the code is decoded and executed with eval. The analytics kept working, so nothing looked wrong to shoppers.
The skimmer stays idle unless the page address contains checkout.convertr. On those pages, it reads card details and the CPF from the payment form and from requests the checkout sends to its payment API. When the shopper places an order, it joins the values into a pipe-delimited record tagged ctr, encodes it in base64 and sends it to 1x0[.]is/ws.
The attacker refined the code within 2 days. The first version, spotted on October 24, matched generic card field names. A second version, pushed on October 26, targeted the exact field names used by Convertr’s payment API.
Unpatched Plausible server is the suspected way in
According to Sansec, Convertr installed Plausible Community Edition 3.0 in 2025 and never updated it. Versions 3.0.0 through 3.2.0 are affected by CVE-2026-8467, a critical flaw that lets anyone run commands on the server through a component library exposed at /storybook without a login. Plausible fixed the issue in version 3.2.1 in May 2026.
Plausible serves the tracker straight from a file on disk, so anyone who can run commands on the server can rewrite it. Sansec stresses that it has not seen Convertr’s server logs and cannot confirm this flaw was the entry point.
Group behind the skimmer has hit Brazilian stores since 2024
Sansec ties the attack to a Magecart group it has tracked since July 2024. The group has infected dozens of Magento, OpenCart and WooCommerce stores, almost all in Brazil, and some stores ran its skimmer for nearly 2 years. Until now it compromised stores one at a time. Sansec describes Convertr as the first supply chain attack it has seen from the group.
The researchers say the group’s habits have stayed consistent:
- Stolen data packed into a pipe-delimited record that ends with a short victim tag
- Exfiltration scripts with Portuguese names such as
cartao.phpandpagamento.php - Short exfiltration domains, mostly 3-letter
.isnames such assnf[.]is,anl[.]isand1x0[.]is, swapped every few months - Skimmers for Brazilian payment methods including e.Rede, PagSeguro, Pagar.me and Mercado Pago, plus a variant that swaps the PIX payment QR code for the attacker’s own
Convertr removes the code but says no store was affected
Sansec says it notified Convertr and received no reply before publishing on October 26, when Convertr was still serving the skimmer. On October 27, Convertr removed the malicious code and upgraded Plausible to a patched version, and Sansec confirmed the tracker was clean. Convertr told the researchers it was notifying affected merchants, payment providers and the relevant authorities.
In a statement posted to its blog on October 27, however, Convertr said its investigation found that no store on the platform was affected. The company said the code could only activate on a specific technical address that no store ever used as its checkout page, because each store runs on its own domain and card details are always entered on that domain. Convertr said it removed the code and updated the analytics component as a precaution. The statement was no longer available on Convertr’s website when BreachNews checked on October 28.
The 2 accounts conflict on whether real shoppers ever paid on a page containing checkout.convertr.
What shoppers and merchants should do
Sansec advises anyone who paid by card on a Brazilian store since October 24, on a payment page whose address contained checkout.convertr, to ask their bank to block and replace the card and to watch for fraud using their CPF. Browsers can cache the infected script for up to 24 hours, so the risk may have lasted beyond the cleanup.
Convertr merchants should get written confirmation that the tracker is clean and alert their payment provider. Anyone running Plausible Community Edition should upgrade to 3.2.1 or later and check access logs for requests to /storybook.
The incident follows other script-based skimming campaigns, including the Magento loader campaign that infected 953 online stores. In 2024, Sansec also reported that the Polyfill.io supply chain attack pushed malicious code to more than 100,000 websites through a single shared script.
