Hackers Hijack Convertr Analytics Script to Steal Payment Cards
Security researchers discovered a supply-chain attack targeting e-commerce platform Convertr, where hackers injected malicious code into an analytics tracker to capture shoppers' payment card details.
Radwan AbdulhadiEditor and technology writer
Convertr E-Commerce Platform Targeted in Supply-Chain Attack
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. According to details reported by [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/), the security incident affects a Brazilian e-commerce provider that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.
The campaign was identified on October 24 and has been attributed to a Brazilian gang active since at least July 2024. This specific threat group focuses on infecting online stores running platforms such as Magento, OpenCart, and WooCommerce.
Exploitation of Plausible Tracker and Vulnerability Suspicions
E-commerce security firm Sansec noted that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr. The platform utilized a self-hosted server for Plausible, which serves as an open-source alternative to Google Analytics managed directly by Convertr.
As [Sansec confirmed](http://sansec.io/research/convertr-plausible-supply-chain-attack), researchers suspect that the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr's outdated Plausible Community Edition installation, to gain initial access, though this vector has not been officially confirmed.
Malicious Code Injection and Payment API Targeting
After gaining access, the attackers injected malicious code into the legitimate Plausible analytics tracker hosted on Convertr's infrastructure. Because this script loads on the checkout pages of all merchants using the platform, the compromise had a wide reach.
Sansec observed that earlier versions of the skimmer used generic payment-field patterns. However, by October 26, the attackers pushed a more refined version that specifically targeted Convertr's exact payment API field names to effectively capture sensitive financial data from checkout pages.
Remediation Efforts and Guidance for Impacted Shoppers
Following the discovery, Sansec confirmed that Convertr removed the skimmer and upgraded Plausible to a patched version. The platform also announced that it was actively notifying affected merchants and payment providers regarding the security breach.
Researchers suggest that anyone who paid by card on a Brazilian store containing the 'checkout.convertr' string in the checkout address page since October 24 should contact their bank immediately to request a card block. Additionally, security experts warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, meaning customers should clear their cache before placing new orders.
Sources
- BleepingComputerHackers hijack Convertr analytics script to steal payment card data
Continue chronologically
Related stories
BlockStrap flaw puts Magento servers at code-execution risk
Researchers warn that a critical BlockStrap flaw in Magento and Adobe Commerce could soon let attackers execute PHP code on store servers.
Mirai Botnet Operators Join PHP2Shell Attacks
Mirai botnet operators and attackers target PHP2Shell flaws as ASLR bypass exploits emerge, though no successful compromises are yet confirmed.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
PHP Warns Admins to Prepare for Two Critical Security Patches
PHP maintainers have issued an urgent warning to web developers and administrators to prepare for the release of two critical emergency patches.
