Convertr: shared analytics script on a Brazilian e-commerce platform hijacked to skim cards at every merchant checkout

What happened

• Sansec found that attackers modified the Plausible analytics tracker served from a self-managed Convertr server; the script loads on checkout pages of all merchants on the platform (including dozens of major fashion brands) and stole card numbers, expiry dates, CVVs, cardholder names and CPF taxpayer IDs from 24 Oct 2026, with a refined skimmer pushed 26 Oct. No merchant or card counts given.
• Root cause: Sansec suspects CVE-2026-8467, an unauthenticated command-execution flaw in an outdated Plausible Community Edition install (not confirmed).
• A Brazilian card-skimming group active since at least July 2024 (Sansec).
• Per Sansec, Convertr removed the skimmer, upgraded Plausible and is notifying merchants and payment providers; Convertr did not respond to BleepingComputer.

Sources

• https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/
• https://sharkstriker.com/blog/october-2026-data-breaches/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.