Hackers hijack Convertr analytics script to steal payment card data

A Brazilian card-skimming group compromised a shared Plausible analytics tracker hosted by e-commerce platform Convertr and injected code to steal payment data on checkout pages. The campaign was spotted on October 24; Convertr has since removed the skimmer and upgraded Plausible to a patched version.

• Convertr powers stores handling R$2 billion ($370M) in sales
• Campaign attributed to a Brazilian gang active since July 2024
• Attackers likely exploited CVE-2026-8467 in outdated Plausible
• Browser caching may keep the malicious script active for 24 hours