GoKawiilConvertr's Plausible analytics script hijacked to skim card data at Brazilian checkouts
Security firm Sansec says a Brazilian credit-card skimming group compromised a shared Plausible analytics tracker hosted on e-commerce platform Convertr's infrastructure, injecting malicious code that loads on checkout pages across the dozens of fashion merchants it serves. The skimmer, identified on October 24 and refined by October 26 to match Convertr's specific payment API fields, was designed to capture card numbers, expiration dates, CVVs, cardholder names and CPF tax IDs.
GoKawiil's interpretation of the reporting above, not reported fact.
Sansec suggests the attackers may have exploited an unpatched vulnerability in an outdated Plausible Community Edition install, though this remains unconfirmed, highlighting how a single compromised third-party script can expose many merchants at once. Because Convertr processes roughly $370 million in annual sales, the breach could affect a large volume of shoppers who used card payments on affected stores since October 24.
- A Brazilian skimming gang allegedly compromised Convertr's shared Plausible analytics tracker to inject card-stealing code.
- The malicious script targeted checkout pages across multiple fashion e-commerce brands using Convertr, capturing card and CPF data.
- Sansec suspects but has not confirmed exploitation of an unauthenticated vulnerability in an outdated Plausible installation as the entry point.
Source: bleepingcomputer.com, 2026-10-27
Published there as: “Hackers hijack Convertr analytics script to steal payment card data”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.