Attackers added a payment-card skimmer to a shared analytics script served by Brazilian commerce platform Convertr, according to security firm Sansec. Every Convertr checkout loaded that tracker, turning one altered file into a route to multiple merchants’ payment forms.

Bill Toulas’s October 27 report follows Sansec’s October 26 investigation, updated October 27. Sansec says it confirmed the served tracker was clean at 13:08 UTC on October 27, after Convertr reported removing the skimmer and patching its analytics installation.

Evidence status: researcher-reported malicious code on a live shared tracker, followed by verified cleanup of that tracker. The reviewed sources provide no count of stolen cards or independently audited merchant-by-merchant exposure.

A checkout script can read more than analytics

Convertr hosted its own Plausible Community Edition, an open-source analytics service. Sansec found added code that activated on checkout addresses containing checkout.convertr. It collected card numbers, expiry dates, security codes, cardholder names and CPF numbers, Brazil’s taxpayer identifiers.

The researcher observed a generic version on October 24 and a more tailored version on October 26. The later script targeted Convertr’s payment API field names. Sansec attributes the campaign to a group it has tracked since 2024; that attribution remains the researcher’s assessment.

A checkout loading the shared file establishes a delivery path. It does not establish that every merchant had a shopper submit card details during the affected period.

The Plausible flaw is a suspected entry point

Sansec suspects CVE-2026-8467 enabled access to Convertr’s outdated Plausible installation. It explicitly says it has not seen Convertr’s server logs and cannot confirm that entry point.

The Plausible maintainer advisory, published June 3, confirms a separate, established vulnerability:

  • Affected: Community Edition 3.0.0 through versions before 3.2.1.
  • Fixed: 3.2.1, which removes the vulnerable /storybook endpoint.
  • Impact: an unauthenticated user can execute code inside the Plausible service container.
  • Interim control: block that endpoint at the reverse proxy or firewall if an immediate update is impossible.

That older advisory supports the patch advice. It does not prove this CVE caused Convertr’s intrusion, or implicate Plausible’s hosted service.

Cleanup, cached scripts and card replacement are separate tasks

For shoppers: Sansec advises anyone who paid by card on a Brazilian store’s checkout.convertr page since October 24 to contact their bank about blocking and replacing the card. Watch for misuse involving the CPF too. Use the bank’s known app or contact details.

Sansec warns that browsers can retain the infected script for up to 24 hours after cleanup. Clearing the relevant cache before another purchase addresses that residual copy; it cannot recover details already sent to an attacker.

For Convertr merchants: obtain platform confirmation that the tracker is clean, coordinate with the payment provider and follow affected-customer notification requirements. Sansec says Convertr reported notifying merchants, payment providers and authorities. Request the actual exposure interval for your checkout rather than deriving a victim count from the platform’s total sales.

For self-hosted Plausible operators: install a supported release carrying the 3.2.1 fix. Review access logs for /storybook and investigate unfamiliar processes or outbound connections. The maintainer says suspicious activity warrants treating the container as compromised and rotating every secret accessible to it. Sansec additionally recommends rebuilding and comparing tracker files with the official release.

The incident also makes checkout-script ownership a security question: inventory which shared services can change code running beside payment fields, and who verifies those changes.

Caveat: Sansec sells ecommerce security products and supplies the underlying forensic account. The initial access method and full theft scope remain unresolved in the reviewed reporting.