EN PT-BR
← Voltar ao feed
high retail e-commerce fashion

Brazilian skimming gang compromises Convertr's Plausible analytics file in supply-chain attack, stealing card data and CPFs at checkout

2 fonte(s) · 2 atualização(ões) · publicado 27/10/2026 15:59 · coletado há 5 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 28/10/2026 00:01; os links antigos trazem para cá.

Fontes: bleepingcomputer.com ↗ olhardigital.com.br ↗

A Brazilian card-skimming group, tracked by Sansec since July 2024, injected a payment skimmer into a Plausible analytics file on a self-managed server run by e-commerce platform Convertr. The platform powers dozens of Brazilian fashion brands and handles about R$2 billion ($370M) in sales (bleepingcomputer.com). The malicious code loaded on the checkout pages of every merchant on the platform and, from 24 October 2026, captured card data and CPF taxpayer numbers (olhardigital.com.br). Sansec says this is the group's first supply-chain attack. Earlier attacks hit individual Magento, OpenCart and WooCommerce stores, mostly in Brazil. On 27 October Convertr said it had removed the malicious code, updated its system and begun notifying merchants, payment providers and authorities. Sansec confirmed the same day that the tampered file was clean (olhardigital.com.br). The initial access vector is still unconfirmed.

Entenda a falha

A vulnerabilidade

CVE-2026-8467 is an unauthenticated command-execution flaw in Plausible Community Edition, the self-hosted open source analytics tool. It affects versions 3.0.0 to 3.2.0 and was fixed in 3.2.1 in May 2026. An attacker with network reach to the server needs no login and can run commands on it through the /storybook component. Convertr was running an outdated 3.0 installation, not updated since 2025. Sansec suspects this was the way in, but could not confirm it because it had no access to the server logs.

Como funciona

The Plausible tracker file is served from a self-managed Convertr server and loaded by the checkout pages of every merchant on the platform. According to Sansec, the attackers modified that single legitimate file, possibly after reaching the server through the unauthenticated flaw. When a shopper opened a checkout page, the browser loaded the altered file and the skimmer ran in the page. It captured data typed during payment and data exchanged between the checkout page and the payment system, then sent it to the attacker domain 1x0.is when the order was completed. Early versions used generic payment-field patterns; by 26 October the attackers had a version targeting Convertr's exact payment API field names.

Por que é vulnerável

The suspected root cause is a missing authentication check that lets an unauthenticated visitor reach command execution through /storybook in Plausible Community Edition 3.0.0 to 3.2.0. The articles do not describe the code-level defect. The flaw stayed exploitable because the Convertr instance was never updated after 2025, even though 3.2.1 fixed it in May 2026. The wider weakness is design: one self-hosted script was trusted by every merchant's checkout page, so changing one file exposed all stores. The fix was upgrading to a patched Plausible and removing the skimmer.

Onde está

The vulnerable component is the /storybook endpoint of Plausible Community Edition; the articles name no file, function or commit, and the abused asset was the Plausible tracker file on Convertr's server.

Como foi descoberta

Sansec, an e-commerce security firm, identified the campaign and attributes it to a Brazilian skimming group it has tracked since July 2024. This is the group's first supply-chain attack; earlier ones hit individual Magento, OpenCart and WooCommerce stores, mostly in Brazil. Olhar Digital says the skimmer captured data from 24 October, while BleepingComputer says Sansec identified the campaign on 24 October, so it is unclear whether that is the start of the theft or the discovery date. On 27 October Convertr said it had removed the code, updated the system and begun notifying merchants, payment providers and authorities, and Sansec confirmed the file was clean. The CVE link is only a suspicion, as Sansec had no server logs, and BleepingComputer had no reply from Convertr when it published.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 00:17.

Detalhes técnicos

  • The attackers modified a single file that collects site access analytics. Convertr uses Plausible, an open-source traffic analytics tool. Checkout pages load this file, so the skimmer reached shoppers on every store using the platform (olhardigital.com.br, bleepingcomputer.com).
  • The skimmer captured data entered during payment and data exchanged between the checkout page and the payment processing system. It sent the data to the attacker-controlled domain 1x0.is when the customer completed the order (olhardigital.com.br).
  • Exposed data: card number, expiry date, CVV and CPF (olhardigital.com.br).
  • Early skimmer versions used generic payment-field patterns. By 26 October the attackers had pushed a refined version targeting Convertr's exact payment API field names (bleepingcomputer.com).
  • Suspected entry point: Convertr ran an outdated Plausible Community Edition 3.0, not updated since 2025. CVE-2026-8467 affects versions 3.0.0 to 3.2.0 and allows unauthenticated command execution through the /storybook component. It was fixed in 3.2.1 in May 2026. Sansec could not confirm exploitation because it had no access to the server logs (olhardigital.com.br, bleepingcomputer.com).
  • Browsers may cache the infected copy for up to 24 hours after the fix (olhardigital.com.br, bleepingcomputer.com).

Remediação

  • Shoppers who paid by card since 24 October on a page whose URL contained checkout.convertr should ask their bank to block and replace the card, and watch for CPF-related fraud (olhardigital.com.br, bleepingcomputer.com).
  • Clear the browser cache before placing new orders, since the malicious script may stay active for up to 24 hours after cleanup. Disposable virtual cards that expire after a transaction limit exposure (bleepingcomputer.com).
  • Merchants using Convertr should confirm with the platform that the file was fixed and notify their payment providers (olhardigital.com.br).
  • Operators of self-hosted Plausible should update to 3.2.1 or later, check for suspicious access to /storybook, and keep self-hosted analytics software patched (olhardigital.com.br, bleepingcomputer.com).

Relatos divergentes

  • Date: olhardigital.com.br says the skimmer captured data from 24 October. bleepingcomputer.com says Sansec identified the campaign on 24 October. The sources do not say whether this is the start of the theft or the date of discovery.
  • Entry point: both sources agree that CVE-2026-8467 is only suspected. olhardigital.com.br adds that Sansec lacked server logs, and bleepingcomputer.com says it has not been confirmed. No source confirms exploitation.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 27/10/2026 17:57 · coletado 27/10 19:00

    Brazilian skimming gang hijacks Convertr's Plausible analytics script to steal card data at checkout

    ler a análise desta fonte

    A Brazilian card skimming group, active since at least July 2024, reportedly compromised a Plausible analytics tracker file hosted on a self-managed server operated by e-commerce platform Convertr. The malicious code loaded on the checkout pages of every merchant on the platform, which powers dozens of major Brazilian fashion brands and handles about R$2 billion ($370M) in sales. Sansec identified the campaign on October 24. Convertr has since removed the skimmer and upgraded Plausible to a patched version, and says it is notifying affected merchants and payment providers.

    Technical Details

    • Sansec suspects initial access came through CVE-2026-8467, an unauthenticated command-execution vulnerability in Convertr's outdated Plausible Community Edition installation. This has not been confirmed.
    • The attackers modified the legitimate Plausible tracker file, so the skimmer ran on all checkout pages using the platform.
    • Early skimmer versions used generic payment-field patterns. By October 26 the attackers had pushed a refined version targeting Convertr's exact payment API field names.
    • The skimmer steals checkout data, including the CPF taxpayer ID and payment card details.
    • The gang focuses on stores running Magento, OpenCart and WooCommerce.

    Remediation

    • Shoppers who paid by card since October 24 on a Brazilian store whose checkout address contains the string 'checkout.convertr' should contact their bank immediately and ask to block the card.
    • Browser caching can keep the malicious script active for up to 24 hours after cleanup, so customers should clear their cache before placing new orders.
    • Using disposable virtual cards that expire after a transaction limits exposure.
    • Keep self-hosted analytics software such as Plausible patched.
  2. olhardigital.com.br ↗ · pub. 27/10/2026 15:59 · coletado 27/10 17:01 primeiro registro

    Brazilian group compromises Convertr e-commerce platform in supply-chain attack, skimming card data and CPFs from dozens of fashion stores

    ler a análise desta fonte

    A Brazilian criminal group injected a payment skimmer into the Convertr e-commerce platform, used by dozens of fashion brands. From 24 October 2026 it captured credit card data and CPF numbers at checkout. Sansec identified the attack. On 27 October Convertr said it had removed the malicious code, updated its system and begun notifying merchants, payment providers and authorities. Sansec has tracked the group since July 2024 and says this is its first supply-chain attack; earlier attacks hit individual stores on Magento, OpenCart and WooCommerce, mostly in Brazil.

    Technical Details

    • The attackers modified a single file in the Convertr system that collects site access analytics. Convertr uses Plausible, an open-source traffic analytics tool. Checkout pages load this file, so the skimmer reached shoppers on every store using the platform.
    • The skimmer captured data entered during payment and data exchanged between the checkout page and the payment processing system. It sent the data to the attacker-controlled domain 1x0.is when the customer completed the order.
    • Exposed data: card number, expiry date, CVV and CPF.
    • Possible entry point: Convertr ran an outdated Plausible Community Edition 3.0 (unupdated since 2025). CVE-2026-8467 affects versions 3.0.0 to 3.2.0 and allows unauthenticated command execution on the server through the /storybook component. It was fixed in 3.2.1 in May 2026. Sansec could not confirm this vulnerability was exploited, as it had no access to the server logs.
    • Sansec confirmed on 27 October that the tampered file was clean. Browsers may cache the infected copy for up to 24 hours after the fix.

    Remediation

    • Shoppers who paid by card since 24 October on a page whose URL contained checkout.convertr should ask their bank to block and replace the card, and watch for CPF-related fraud.
    • Merchants using Convertr should confirm with the platform that the file was fixed and notify their payment providers.
    • Operators of self-hosted Plausible should update to 3.2.1 or later and check for suspicious access to /storybook.