Emerging ThreatsMalware & Ransomware

Hackers Inject Skimmer into Convertr Analytics Script to Steal Payment Data

Analyst 207||Source: BleepingComputer
Retail store checkout counter with payment terminal and laptop in background.

"Convertr removed the skimmer and upgraded Plausible to a patched version," Sansec wrote in an update — an admission that a shared analytics script was turned into a live card‑skimmer on dozens of Brazilian storefronts.

How the Plausible tracker on Convertr was turned into a skimmer

Researchers at ecommerce security firm Sansec found that attackers modified a Plausible analytics tracker file hosted on a self‑managed server run by Convertr. Plausible is an open‑source alternative to Google Analytics; Convertr was running a self‑hosted Plausible Community Edition instance that Sansec says was outdated. After gaining access to that server, attackers injected malicious JavaScript that loaded on the checkout pages of all merchants using Convertr's checkout infrastructure.

Suspected initial access: CVE-2026-8467 and timeline

Sansec suspects the intrusion exploited CVE‑2026‑8467, described in the reporting as an unauthenticated command‑execution vulnerability affecting Convertr's outdated Plausible installation, though the firm noted that this has not been confirmed. The campaign was identified on October 24; by October 26 the attackers had pushed a more refined version of the skimmer that specifically targeted Convertr’s exact payment API field names rather than relying on earlier, generic payment‑field patterns.

What data the injected skimmer stole

The malicious script was configured to harvest full payment details entered during checkout. Sansec lists the types of information taken as:

  • Payment card number
  • Expiration date
  • CVV code
  • Cardholder name
  • CPF taxpayer identification number

Sansec advised that anyone who paid by card on a Brazilian store whose checkout page URL contained the string "checkout.convertr" since October 24 should contact their bank immediately and ask to block their card. The researchers also warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, and advised customers to clear their browser cache before placing new orders, even after the threat has been removed.

Attribution, scale, and affected merchants

BleepingComputer reports the campaign has been attributed to a Brazilian gang active since at least July 2024 that focuses on infecting online stores running Magento, OpenCart, and WooCommerce. Convertr itself is described in the reporting as a Brazilian e‑commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion (US$370 million) in sales — underscoring the potential scale of exposure when a shared script on the platform was compromised.

How shoppers, merchants, and security teams should respond

Shoppers: Follow Sansec’s guidance: if you entered card details on any checkout page containing "checkout.convertr" since October 24, contact your bank and consider blocking or replacing the card. Clear your browser cache before attempting further purchases. One mitigation noted in the reporting is using disposable virtual cards that expire immediately after a transaction.

Merchants on Convertr: Convertr announced it is notifying affected merchants and payment providers, and Sansec confirmed the company “removed the skimmer and upgraded Plausible to a patched version.” Merchants should verify their checkout pages do not still load the compromised script and confirm payment‑field integrity with Convertr and their payment processors.

Security teams and platform operators: The incident highlights the risk of self‑hosted, outdated third‑party components. Sansec’s timeline — from initial identification on October 24 to a refined skimmer by October 26 — shows attackers iterating quickly to match platform‑specific APIs. The reporting also cites the Blue Report 2026 observation that “overall prevention scores can hide what happens after initial access” and that defenses fall once attackers obtain valid credentials; the Blue Report 2026 is said to measure defenses technique‑by‑technique across 338 million simulations in customer environments.

Convertr confirmed corrective action in the form of removal and an upgrade; BleepingComputer contacted Convertr for a statement but had not received a response at the time of reporting. The immediate, practical questions for merchants are whether cached copies of the script remain in customers' browsers and whether payment providers have detected and acted on suspicious transactions. For customers, the clear next step is bank notification and card replacement where appropriate.

Original reporting: https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/

BrazilEmerging ThreatsJavascriptSupply ChainMalware OperationsEcommerce SecurityCard SkimmingPayment Data SkimmerPlausibleConvertr
Related Intelligence

Continue Reading

Hospital corridor with medical staff and concerned expressions under soft daylight.

Ransomware Gang Targets UNM Health, Exposes Sensitive Data

A ransomware gang has launched a devastating attack on UNM Health, compromising a staggering 36,000 systems and disrupting critical patient care and academic activities. The breach has forced the hospital to limit new admissions, divert ambulances, and suspend surgeries and appointments.

Analyst 207
Rows of computer servers and networking equipment in a brightly-lit Japanese office server room.

AI-Driven Attacks Target Japan with Automated Hacking Tools

In a chilling October 2026 campaign, 44 AI agents were unleashed to automate a sophisticated hacking operation, complete with fake login pages and standardized reports in Japanese. This cutting-edge attack used the open-source tool CyberStrikeAI to streamline every step of the intrusion process.

Analyst 207
Blurred computer workstation in a dimly lit online retail store's back office with stacks of boxes and shelves in the…

Magento Sites Compromised by Advanced Scanner-Evading Malware

A sneaky malware attack has hit 953 online stores, mostly running on Magento, with a clever JavaScript loader that can tell real customers from automated security scanners - and gives scanners the cold shoulder. This stealthy campaign has been active since July 2025, quietly evading detection and putting unsuspecting shoppers at risk.

Analyst 207
Hospital corridor with medical staff amidst closed department doors, natural daylight casting a calm atmosphere.

Ransomware Targets UNM Health, Disrupts Medical Operations

A ransomware attack forced UNM Health to shut down its facilities on October 26, prompting patients to seek emergency care elsewhere and delay non-emergency visits until further notice. All appointments, including surgeries, were cancelled for the day, but hospitals reopened and regular operations resumed later that evening.

Analyst 207