Ecommerce security firm Sansec said a Brazilian Magecart group appended a payment-card skimmer to a shared analytics script used by Brazilian platform Convertr, so checkouts loading that file sent shoppers' card details and CPF taxpayer numbers to an attacker-controlled server from Oct. 24². BleepingComputer, citing the same campaign, said the group has targeted online stores running Magento, OpenCart and WooCommerce since at least July 2024¹.

Convertr operates online stores and checkouts for Brazilian fashion brands and has said its merchants have sold more than 2 billion reais through the platform, according to Sansec². Sansec said every Convertr checkout loads a tracker from analytics.convertr.app.br, Convertr's own Plausible analytics server, and that attackers added malicious code to that one file².

Sansec said the extra code ran only on pages whose address included checkout.convertr². It said the malware read card number, expiry, CVV, cardholder name and CPF from the payment form and from checkout requests to Convertr's payment API, then sent the data when an order was placed².

The firm said it last saw a clean copy of the tracker on Oct. 24, detected the skimmer later that day, and observed an updated version on Oct. 26 that targeted Convertr's payment-API field names². Sansec said it notified Convertr and received no response, and that Convertr was still serving the skimmer on Oct. 26². BleepingComputer independently described the incident as a compromise of a shared Convertr analytics script used to steal payment data at checkout¹.

Sansec has tracked the same group since July 2024 and said it had previously infected stores one at a time rather than through a platform script². A matching exfiltration endpoint appeared a day earlier on another Brazilian store, Sansec said².

Sansec said Convertr installed Plausible Community Edition 3.0 in 2025 and did not update it². Versions 3.0.0 through 3.2.0 have a critical flaw, CVE-2026-8467, that Plausible said it fixed in May 2026; Sansec suspects that path because an attacker who could change the on-disk tracker file would infect every site embedding it, but it said it has not seen Convertr's logs and cannot confirm how the file was changed².

BleepingComputer later reported that Sansec confirmed Convertr had removed the skimmer and upgraded Plausible to a patched version, and that Convertr said it was notifying affected merchants and payment providers¹. BleepingComputer said it had contacted Convertr and had not received a response of its own¹.

Sansec told shoppers who paid by card on a Brazilian store since Oct. 24 on a checkout.convertr page to ask their bank to replace the card and to watch for CPF-related fraud². It said browsers may cache the infected script for up to 24 hours after cleanup^1,2.