Security researchers have uncovered a cyberattack campaign targeting the Brazilian e-commerce platform Convertr, where attackers successfully manipulated a shared analytics script to steal shoppers' payment card data during the checkout process. This operation serves as a model for "web skimming" attacks targeting software supply chains to access sensitive data.
Attack Details and Exploited Vulnerability
According to e-commerce security firm Sansec, the campaign was detected on October 24 and attributed to a Brazilian gang active since July 2024. This group focuses on infecting online stores relying on Magento, OpenCart, and WooCommerce platforms. In this case, the attackers targeted a tracking file for Plausible, an open-source alternative to Google Analytics, which was hosted by Convertr on its own servers.
It is suspected that the attackers exploited the vulnerability CVE-2026-8467, an unauthenticated remote code execution vulnerability affecting older versions of the Plausible Community Edition. Once the server was breached, the attackers injected malicious code into the legitimate tracking script, which automatically loads on the checkout pages of all stores using the Convertr platform.
Evolution of Theft Methods and Targeted Data
Researchers pointed out that the attackers rapidly developed the malicious code; while early versions used generic patterns for payment fields, a more precise version appeared on October 26 specifically targeting the API field names of the Convertr platform. The data stolen included payment card numbers, expiration dates, verification codes (CVV), cardholder names, and the Brazilian tax ID number (CPF).
The Convertr platform is a major player in the Brazilian market, supporting payment systems for dozens of major brands in the fashion sector and managing sales estimated at around 2 billion Brazilian reals (approximately $370 million).
What Practically Changes for Users and Stores?
Sansec confirmed that Convertr removed the malicious code and upgraded the Plausible tool to a secure version, and has begun notifying affected stores and payment service providers. However, researchers warned that browser "caches" may keep the malicious script active for users for up to 24 hours after the cleaning process.
Why does this news matter?
- Third-Party Risks: The attack demonstrates how a vulnerability in a simple analytics tool can lead to a large-scale financial breach of an entire e-commerce platform.
- Importance of Updates: Exploiting a vulnerability in outdated open-source software underscores the necessity of continuous monitoring of self-hosted infrastructure vulnerabilities.
- Security Recommendations: Shoppers who used sites associated with the platform since October 24 are advised to review their banks immediately, and it is preferable to use virtual payment cards that expire after a single transaction to reduce digital skimming risks.