A skimming gang hid in a marketing script to lift card numbers at checkout

A Brazilian Magecart card-skimming group planted a payment stealer inside an analytics and marketing script that Convertr serves to the online stores it runs, so every checkout that loaded the file handed over card numbers. Sansec’s forensics team detected the skimmer on 24 October 2026, and Convertr reported it removed on 27 October. The shops were legitimate, and the damage came from code they loaded on purpose.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

Convertr runs the storefronts and checkout pages of dozens of Brazilian fashion brands, and says its merchants have sold more than R$2 billion through the platform. The gang did not need to break into each shop. It changed the one shared file that all of those checkouts load, so a single edit reached every merchant at the same moment, and Sansec says shoppers who paid by card on a Convertr checkout since 24 October should treat the card as exposed.

One tracker file, every Convertr checkout

Sansec’s forensics team, which published its analysis on 26 October and updated it on 28 October, located the skimmer in a file named script.pageview-props.tagged-events.js served from analytics.convertr.app.br, Convertr’s own analytics server. The file is the stock Plausible tracker followed by an obfuscated block that is decoded and run with eval. The code activates only on pages whose address contains checkout.convertr, so ordinary browsing of the shops showed nothing unusual. Sansec recorded the last clean copy at 05:03 UTC on 24 October and detected the skimmer at 23:22 UTC the same day.

Once active, the skimmer reads the card number, expiry date, CVV, cardholder name and CPF, the Brazilian taxpayer ID, from the payment form and from requests the checkout sends to its payment interface. When the shopper places the order, it packs the data into a pipe-delimited record, encodes it in base64 and sends it by POST to 1×0.is, an attacker-controlled server, tagging each record with ctr for Convertr. The first version, from 24 October, used generic field patterns. By 26 October the attacker had shipped a version aimed at Convertr’s exact payment field names.

An old Plausible install and a May patch

Sansec says Convertr installed Plausible Community Edition 3.0 in 2025 and never updated it. Versions 3.0.0 through 3.2.0 are affected by CVE-2026-8467, a critical flaw that lets anyone run commands on the server through a component library exposed at /storybook without logging in, and Plausible’s security advisory describes the fix, released in version 3.2.1 on 15 May 2026. Sansec labels that the suspected way in. It has not seen Convertr’s server logs, so it cannot confirm it.

Convertr did not answer Sansec’s notification before publication and was still serving the skimmer at 15:34 UTC on 26 October.

The Brazilian group behind the skimmer

Sansec describes the actor as a Brazilian Magecart group active since 2024 that has infected dozens of Magento, OpenCart and WooCommerce stores, almost all in Brazil, with some carrying its skimmer for nearly two years. Convertr is the first supply-chain attack Sansec has seen from the group. Its usual tooling targets Brazilian payment methods, among them e.Rede, PagSeguro, Pagar.me and Mercado Pago, and one variant swaps a shop’s PIX payment QR code for the attacker’s own.

BleepingComputer also reported the compromise, describing a shared Convertr analytics script used to capture payment details at checkout. Convertr told Sansec it removed the skimmer and upgraded Plausible to a patched version, and says it is notifying affected merchants, payment providers and the relevant authorities. For shoppers who paid with a card since 24 October on a page with checkout.convertr in the address, Sansec advises asking the bank to block and replace the card and watching for fraud tied to the CPF. Browsers may keep the infected script cached for up to 24 hours after the cleanup.

Self-hosted analytics servers are the other group of people who need to act. Sansec tells anyone running Plausible Community Edition to upgrade to 3.2.1 or later and to search access logs for requests to /storybook, the path the critical flaw exposes. If any exist, the advice is to rebuild the server instead of cleaning it, rotate its secrets and compare the files in priv/tracker/js with the official release, because the tracker is JavaScript that every visitor’s browser runs. In the Convertr case that is exactly how the skimmer travelled: nothing was installed on the shops themselves, and the altered file sat on a server Convertr operated.

Sansec lists indicators so stores can search their own logs. The exfiltration address in the first and later versions of the skimmer is 1×0.is, and the infected file carried the SHA-256 hash ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 on 26 October. The same group has used 14 exfiltration domains in all, among them snf.is, anl.is, kof.one, nmn.is and shy.is, plus fasthook.app, and some builds send stolen data to Discord webhooks or to scripts planted on other hacked shops rather than to a dedicated server of their own.

Merchants on the platform are told to ask Convertr to confirm the tracker is clean and to inform their payment provider, and anyone self-hosting Plausible should move to 3.2.1 or later and check access logs for /storybook requests. Sansec’s timeline puts the removal at 12:54 UTC on 27 October and its own confirmation of a clean tracker at 13:08 UTC. Nobody has published how many shoppers entered card details during the three days the skimmer ran.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.