The Convertr analytics skimmer did not arrive as a new script. A Brazilian card-skimming gang rewrote the self-hosted Plausible tracker that e-commerce platform Convertr loaded on every merchant checkout, according to Sansec, which identified the campaign on October 24. Any Cyprus firm whose payment page runs code it does not control faces the same risk.
Key takeaways
- Attackers rewrote Convertr's self-hosted Plausible tracker, turning every merchant checkout into a card skimmer from October 24.
- Sansec suspects CVE-2026-8467 in an outdated Plausible Community Edition install; the entry point is unconfirmed.
- PCI DSS 6.4.3 and 11.6.1 require a payment-page script inventory and browser-side change detection.
What happened to Convertr's Plausible tracker?
Attackers edited the analytics file Convertr served to its merchants’ checkout pages, and it copied card data as shoppers typed it: card number, expiry date, CVV, cardholder name and CPF, Brazil’s taxpayer ID.
Convertr runs storefronts and checkout for dozens of major Brazilian fashion brands, handling about R$2 billion (roughly $370 million) in sales, a platform figure, not a breach figure. The tracker was a self-hosted Plausible Community Edition instance on Convertr’s own servers.
Sansec attributes the campaign to an unnamed Brazilian gang, active since at least July 2024, that focuses on Magento, OpenCart and WooCommerce stores.
Sansec later said Convertr had removed the skimmer, upgraded Plausible to a patched version and begun notifying merchants and payment providers. Convertr had not answered BleepingComputer by publication.
Why the Convertr analytics skimmer reached every checkout
A script can read every form field on the page that loads it, wherever the file is hosted. Convertr referenced the tracker from every tenant’s checkout, so one edited file ran on every store.
The attackers added no new domain. They changed a file the checkout already trusted, so Content Security Policy and allowlists had no reason to flag it. A pinned integrity hash on the checkout tag would have made the browser refuse the tampered file.
Early versions matched generic payment-field patterns; by October 26 the skimmer targeted Convertr’s exact payment-API field names.
Sansec suspects, without confirmation, that the attackers got in through CVE-2026-8467, an unauthenticated command-execution flaw in Convertr’s outdated Plausible build. If so, treat the whole server as compromised: review persistence and exposed credentials, not just the upgrade.
What should Cyprus payment pages check after this?
List every script on your checkout, deposit and cashier pages and name an owner for each. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, mandatory since March 31, 2025, demand that inventory plus detection of unauthorized changes to the page the browser receives.
- Hash the live script and compare it with a known-good build; a trusted hostname can still serve tampered code.
- Search the rendered checkout and tag-manager containers for checkout.convertr or any vendor-hosted Plausible tracker.
- Don’t rely on CSP reports: here they would only fire if stolen data left for a host outside the policy.
- Put patch status and change notification for vendor-hosted analytics in the contract.
- Before cleanup, save the served file, its headers and hashes for the acquirer.
- Assign incident classification in advance: NIS2 Article 23’s 24-hour early warning and DORA’s major-incident thresholds can both apply.
Practitioner’s note: in our iGaming and e-commerce engagements, the payment page the business describes rarely matches what a browser loads; unlisted chat and analytics widgets on cashier pages are routine. Our PCI DSS penetration testing checks against both requirements.
What happens after the skimmer is removed?
Sansec warned that cached copies could keep skimming for up to 24 hours after cleanup.
On your own pages, the window depends on Cache-Control headers and any CDN, so confirm cleanup at the origin, the CDN and a fresh browser fetch. Boards should plan for card reissuance, chargebacks and acquirer scrutiny across every merchant on a platform, even when the compromised server belonged to none of them.
FAQ
Is CVE-2026-8467 the confirmed entry point?
No. Sansec suspects it, but exploitation has not been confirmed.
How do attackers hide a skimmer inside analytics JavaScript?
They edit a file the checkout already loads from a trusted host, so no new domain appears for CSP to catch.
What should I do if I paid on checkout.convertr?
If you paid by card since October 24, ask your bank to block the card and clear your browser cache before ordering again.
If your checkout or cashier page loads vendor or platform scripts, an e-commerce penetration test will show what actually runs there and who controls it.