GoKawiilConvertr's Plausible analytics script hijacked to skim card data at Brazilian checkouts
Security firm Sansec says a Brazilian credit-card skimming group compromised a shared Plausible analytics tracker hosted on e-commerce platform Convertr's infrastructure, injecting malicious code that loads on checkout pages across the dozens of fashion merchants it serves. The skimmer, identified on October 24 and refined by October 26 to match Convertr's specific payment API fields, was designed to capture card numbers, expiration dates, CVVs, cardholder names and CPF tax IDs.