---
title: Magecart skimmer rode Brazilian e-commerce platform Convertr's own Plausible analytics script onto every merchant checkout from Oct 24, taking card numbers, CVVs and CPF tax IDs | ctxsec
url: https://ctxsec.com/items/convertr-plausible-tracker-magecart-skimmer-brazil-oct-24
description: ""
status: "threat research (Sansec, Oct 26-27); Convertr told Sansec it removed the skimmer; entry point suspected, not confirmed; Convertr has not commented publicly"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/convertr-plausible-tracker-magecart-skimmer-brazil-oct-24.md)

threat research (Sansec, Oct 26-27); Convertr told Sansec it removed the skimmer; entry point suspected, not confirmed; Convertr has not commented publicly

2026-10-27

### Magecart skimmer rode Brazilian e-commerce platform Convertr's own Plausible analytics script onto every merchant checkout from Oct 24, taking card numbers, CVVs and CPF tax IDs

Convertr runs online stores and checkouts for dozens of Brazilian fashion brands. Every merchant checkout loads a tracker from `analytics.convertr.app.br`, Convertr's self-hosted **Plausible Community Edition** server. Sansec says a Brazilian Magecart group it has tracked since July 2024 appended an obfuscated skimmer to that one file, so all Convertr checkouts loaded it. It ran only on `checkout.convertr` pages and sent card number, expiry, CVV, cardholder name and **CPF** (the Brazilian taxpayer number) to `1x0.is`. The first version appeared on **Oct 24**; on Oct 26 the attackers updated it to read Convertr's exact payment-API field names.

Sansec suspects, but cannot confirm without server logs, that the way in was **CVE-2026-8467**, an unauthenticated command execution through the `/storybook` component library exposed by Plausible CE 3.0.0-3.2.0, fixed in 3.2.1 in May. Convertr had installed 3.0 in 2025 and never updated it. On **Oct 27** Convertr reported the skimmer removed and Plausible patched, and Sansec confirmed the tracker is clean. Convertr says it is notifying merchants, payment providers and authorities. This is the first supply-chain attack Sansec has seen from this group, which otherwise hits Magento, OpenCart and WooCommerce stores one by one.

**What to do:** anyone who paid by card on a Brazilian store whose payment page address contained `checkout.convertr` since Oct 24 should have the card blocked and replaced and watch for CPF fraud. Browsers can cache the infected script for up to 24 hours after cleanup. Indicators and a self-hosted Plausible check are in [our hunt notes](/items/hunt-convertr-magecart-1x0-is-plausible-storybook).

Sources: [Sansec: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics (Oct 26, updated Oct 27)](https://sansec.io/research/convertr-plausible-supply-chain-attack) · [BleepingComputer: Hackers hijack Convertr analytics script to steal payment card data (Oct 27)](https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/)