Convertr runs online stores and checkouts for dozens of Brazilian fashion brands. Every merchant checkout loads a tracker from analytics.convertr.app.br, Convertr's self-hosted Plausible Community Edition server. Sansec says a Brazilian Magecart group it has tracked since July 2024 appended an obfuscated skimmer to that one file, so all Convertr checkouts loaded it. It ran only on checkout.convertr pages and sent card number, expiry, CVV, cardholder name and CPF (the Brazilian taxpayer number) to 1x0.is. The first version appeared on Oct 24; on Oct 26 the attackers updated it to read Convertr's exact payment-API field names.

Sansec suspects, but cannot confirm without server logs, that the way in was CVE-2026-8467, an unauthenticated command execution through the /storybook component library exposed by Plausible CE 3.0.0-3.2.0, fixed in 3.2.1 in May. Convertr had installed 3.0 in 2025 and never updated it. On Oct 27 Convertr reported the skimmer removed and Plausible patched, and Sansec confirmed the tracker is clean. Convertr says it is notifying merchants, payment providers and authorities. This is the first supply-chain attack Sansec has seen from this group, which otherwise hits Magento, OpenCart and WooCommerce stores one by one.

What to do: anyone who paid by card on a Brazilian store whose payment page address contained checkout.convertr since Oct 24 should have the card blocked and replaced and watch for CPF fraud. Browsers can cache the infected script for up to 24 hours after cleanup. Indicators and a self-hosted Plausible check are in our hunt notes.