Hackers hijack Convertr analytics script to skim payment cards across Brazilian stores

Attackers hijacked an analytics script used by Brazilian e-commerce platform Convertr to deploy a payment-card skimmer across the checkout pages of its merchants, according to BleepingComputer, citing security firm Sansec. Convertr powers online stores and checkout systems for dozens of major Brazilian fashion brands and handles roughly R$2 billion (about $370 million) in sales, BleepingComputer reports.

What happened

Sansec, as reported by BleepingComputer, says the attacker modified a Plausible analytics tracker file hosted on a server that Convertr operates itself. Because that tracker loads on the checkout pages of every merchant on the platform, the injected skimmer code ran for all of them at once. Sansec identified the campaign on October 24, 2026, and BleepingComputer notes it has been linked to a Brazilian group active since at least July 2024 that targets Magento, OpenCart and WooCommerce stores.

Technical details

According to BleepingComputer, Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution flaw in Convertr's outdated Plausible Community Edition, though it has not confirmed this. The report says early versions of the skimmer used generic payment-field patterns, but by October 26 the attackers released a refined version tuned to Convertr's exact payment API field names. BleepingComputer, citing Sansec, says the skimmer was configured to steal card numbers, expiration dates, CVV codes, cardholder names and CPF taxpayer identification numbers. The article does not detail how the stolen data was exfiltrated.

Who is affected

BleepingComputer does not give a figure for the number of shoppers hit, but says the malicious tracker loaded on the checkout pages of all merchants using Convertr. Sansec advises anyone who paid by card at a Brazilian store whose checkout page contained the checkout.convertr string since October 24 to contact their bank and ask to block the card.

What to do

BleepingComputer reports that Convertr removed the skimmer, upgraded Plausible to a patched version, and said it was notifying affected merchants and payment providers; the outlet said Convertr had not responded to its request for comment. Sansec warns that browser caching can keep the malicious script active for up to 24 hours after cleanup, so shoppers should clear their browser cache before placing new orders. Affected cardholders should monitor statements and replace exposed cards.