Skimmers abused Convertr's analytics script to grab checkout card data
Sansec says attackers modified a self-hosted Plausible tracker that loads on every Convertr merchant's checkout page; Convertr says it removed the skimmer and upgraded Plausible.
A card-skimming group reportedly compromised a shared analytics script used by Brazilian e-commerce platform Convertr, turning it into a payment-data stealer on merchant checkout pages. BleepingComputer reported the campaign on October 27, citing e-commerce security firm Sansec.
Sansec says the attacker modified the Plausible tracker file on a self-managed server that Convertr operates. Plausible is an open source analytics alternative to Google Analytics. Because that tracker loads on the checkout pages of all merchants using the platform, one altered file reached many stores at once.
Sansec suspects the attackers got in by exploiting an unauthenticated command-execution vulnerability in Convertr's outdated Plausible Community Edition installation, but the firm says that has not been confirmed. The campaign was identified on October 24 and attributed to a Brazilian gang active since at least July 2024 that targets stores running Magento, OpenCart and WooCommerce.
The skimmer was built to capture card number, expiration date, CVV, cardholder name and the CPF taxpayer identification number. Sansec says early versions used generic payment-field patterns, then a refined version pushed by October 26 targeted Convertr's exact payment API field names.
In an update, Sansec said Convertr "removed the skimmer and upgraded Plausible to a patched version," and that the company said it was notifying affected merchants and payment providers. BleepingComputer said Convertr had not responded to its request for comment.
Sansec warned that browser caching could keep the malicious script active on affected sites for up to 24 hours after cleanup, and advised shoppers to clear their cache before ordering again. It also suggested that anyone who paid by card on a Brazilian store whose checkout address contained the "checkout.convertr" string since October 24 contact their bank and ask to block the card.
For defenders, the case is a reminder that third-party scripts on checkout pages are part of the payment attack surface. Inventorying what loads at checkout, pinning or monitoring script integrity, and keeping self-hosted analytics components current all reduce the window a tampered file can harvest data.
CVE references
Sources
- Hackers hijack Convertr analytics script to steal payment card dataPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
