Skip to content
HACKTECH
Web & CMSReported Published 3 sources

Sansec: card skimmer in Convertr's shared analytics script hit Brazilian checkouts

Sansec reported on 26 October 2026 that a Brazilian Magecart group had appended a card skimmer to the analytics tracker that Convertr, an e-commerce platform running the stores and checkouts of dozens of Brazilian fashion brands, loads on every checkout. The skimmer captured card number, expiry date, CVV, cardholder name and CPF taxpayer number and sent them to 1x0.is. Sansec suspects, but has not confirmed, that the attackers got in through CVE-2026-8467, an unauthenticated code execution flaw reachable through the /storybook endpoint of Convertr's self-hosted Plausible Community Edition 3.0 server, which had not been updated since its 2025 install. Convertr removed the skimmer and patched Plausible on 27 October, Sansec said.

  • Magecart
  • web skimming
  • supply chain
  • Plausible Analytics
  • CVE-2026-8467
  • e-commerce
  • Brazil

What the sources report

  • Sansec saw the last clean copy of the tracker at 05:03 UTC on 24 October 2026 and detected the skimmer at 23:22 UTC the same day; the obfuscated block was appended to the Plausible tracker served from analytics.convertr.app.br, decoded and run with eval, and activated only on checkout.convertr pages.
  • On 26 October the attackers deployed a version targeting the exact field names of Convertr's payment API, replacing the generic field patterns of the first version (Sansec).
  • Plausible's advisory for CVE-2026-8467 (CVSS v4 9.5) covers Community Edition versions from 3.0 before 3.2.1, which exposed an unauthenticated code execution path at /storybook through the phoenix_storybook component library; 3.2.1 removes the endpoint, and Sansec dates the fix to 15 May 2026.
  • Convertr says its merchants have sold more than R$2 billion through the platform (Sansec, BleepingComputer).
  • Sansec has tracked the group since July 2024 across Magento, OpenCart and WooCommerce stores, almost all in Brazil, and says Convertr is the first supply chain attack it has seen from the group.
  • Sansec warned that browsers may cache the infected script for up to 24 hours after cleanup; Convertr said it was notifying affected merchants, payment providers and relevant authorities.

What it means for your organisation

A single unpatched, self-hosted analytics server sat on the checkout path of every merchant on the platform, so one compromise reached all of them at once. Scripts loaded on payment pages, including first-party-hosted tooling, carry the same risk as payment code and need an owner, a patch schedule and integrity monitoring. In this case an outside security firm found the skimmer and the platform had not responded before publication, which argues for monitoring the scripts customers' browsers actually receive.

What we check

  • Inventory every script served on checkout and payment pages, including first-party-hosted analytics and tag managers, and identify who maintains each origin server.
  • Check self-hosted tooling such as analytics, dashboards and component libraries for internet exposure and patch level; for Plausible CE, confirm 3.2.1 or later and search access logs for /storybook requests.
  • Monitor the JavaScript actually delivered to checkout pages against known-good hashes and alert on changes.
  • Review Content Security Policy script-src and connect-src on payment pages for unexpected destinations.
  • Rehearse the response to a client-side skimming incident, including payment provider notification and cache expiry of infected scripts.

Sources

Services that cover these checks

  • Website security audit

    A review of a public website's TLS and security headers, third-party scripts, CMS and plugin versions, forms, authentication and hosting configuration. Every check is marked pass, fail or not applicable with the evidence attached, so the result doubles as a compliance artefact.

    Duration: 3 to 6 working days

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works