Hackers Hijack Convertr Analytics Script to Steal Payment Data

A payment card skimming group reportedly compromised an analytics script used by Brazilian e-commerce platform Convertr to steal shoppers’ payment data during checkout, according to BleepingComputer.

Security firm Sansec said the attackers modified a Plausible analytics tracker hosted on a self-managed Convertr server. The script loads on checkout pages for merchants using the platform. Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution flaw affecting Convertr’s outdated Plausible Community Edition installation, but said this has not been confirmed.

The campaign was identified on October 24. Sansec attributed it to a Brazilian group active since at least July 2024 that targets online stores running Magento, OpenCart, and WooCommerce. By October 26, the skimmer had been updated to target Convertr’s specific payment API field names, Sansec said.

Convertr powers online stores and checkout systems for dozens of major fashion brands in Brazil and handles R$2 billion ($370 million) in sales. Sansec later confirmed that Convertr removed the skimmer and upgraded Plausible to a patched version. The company said it was notifying affected merchants and payment providers.

Sansec warned that browser caching could keep the malicious script active on affected sites for up to 24 hours after cleanup. BleepingComputer said it contacted Convertr for comment but had not received a response.