Hunt: the Brazilian Magecart group behind the Convertr skim posts pipe-delimited card records to short .is domains; check self-hosted Plausible for /storybook hits and a modified tracker

threat research (Sansec IOCs, Oct 26-27)2026-10-27

From Sansec's analysis of the Convertr skim:

Network: POSTs to https://1x0.is/ws (also /ws/<base64>) sent with mode: "no-cors" and keepalive. Earlier exfiltration domains of the same group: snf.is, anl.is, nmn.is, eqp.is, shy.is, blz.is, tray.is, xwv.is, kk.land, kof.one, xsox.diy, miorl.net, fasthook.app, antiddos-protection.net, plus some Discord webhooks.
Payload shape: a base64 record of card|month|year|CVV|CPF|name|tag, ending in a short victim tag (ctr for Convertr). Older builds post to PHP endpoints with Portuguese names such as cartao.php and pagamento.php, and some variants swap the PIX QR code for the attacker's own.
File and strings: the infected file was /js/script.pageview-props.tagged-events.js (SHA-256 ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 on Oct 26). In scripts, look for indexOf('checkout.convertr') and String.fromCharCode(...) followed by (0,eval) appended after legitimate code.
If you self-host Plausible CE: upgrade to 3.2.1 or later, search access logs for requests to /storybook, and compare priv/tracker/js/ against the official release. If you find hits, rebuild the server and rotate its secrets. Any third-party script served from your own infrastructure onto checkout pages deserves file-integrity monitoring and a CSP connect-src allowlist.