How a Hijacked Analytics Script Turned Every Checkout on a Brazilian E-Commerce Platform Into a Card Skimmer
Attackers planted a payment card skimmer in the self-hosted Plausible analytics script used by Brazilian e-commerce platform Convertr, putting it on the checkout pages of every merchant on the platform. Here is how the attack worked, step by step, and what online store owners can do about third-party scripts.
The online stores in this case did nothing wrong on their own websites. The card-stealing code reached their checkout pages through a website-traffic counter that their e-commerce platform ran for all of them.
BleepingComputer reported the attack based on research from e-commerce security firm Sansec. The walkthrough below follows their findings.
The attack, step by step
- Pick a shared target. Convertr is a Brazilian e-commerce platform that powers storefronts and checkout for dozens of major fashion brands in Brazil and has processed about 2 billion reais (around $370 million) in sales. Like many platforms, it ran a tracking script on its merchants’ pages, in this case a self-hosted copy of Plausible, an open-source alternative to Google Analytics.
- Get into the analytics server. The attackers modified the Plausible tracker file on the server Convertr managed. Sansec suspects they used CVE-2026-8467, an unauthenticated command execution flaw in outdated versions of Plausible Community Edition, but that has not been confirmed.
- Ride along to every checkout. Because the tracker loaded on the checkout pages of every merchant on the platform, one changed file put a skimmer in front of all of their shoppers.
- Collect the card data. The skimmer grabbed card numbers, expiration dates, CVV codes, cardholder names and CPF numbers, Brazil’s taxpayer ID.
- Sharpen the tool. Sansec identified the attack on October 24. Early versions looked for generic payment field names. By October 26, the attackers had a refined version aimed at the exact field names used by Convertr’s payment system.
Who is behind it
Sansec ties the attack to a Brazilian skimming gang it has tracked since at least July 2024, which has also hit stores running Magento, OpenCart and WooCommerce.
Where things stand
According to Sansec, Convertr removed the skimmer, upgraded its Plausible installation and is notifying affected merchants and payment providers. Convertr did not respond to BleepingComputer’s request for comment. Browsers may keep the malicious script in their cache for up to 24 hours, so shoppers are advised to clear their cache. Anyone who paid on a Brazilian store whose checkout address included “checkout.convertr” since October 24 should contact their bank.
Checklist for anyone running an online store
- Know every script on your checkout page. Analytics, chat, reviews and marketing tags all run with full access to what shoppers type. Remove anything that does not need to be there.
- Ask your platform the same question. If a hosted platform runs checkout for you, ask which third-party and self-hosted scripts it loads and how it keeps them patched.
- Patch self-hosted tools too. Open-source tools you run yourself, like analytics servers, need updates just like your store software does.
- Lock down what can load. A Content Security Policy and Subresource Integrity checks can stop changed or unexpected scripts from running in shoppers’ browsers.
- Watch for changes. Use a monitoring service or a simple scheduled check that alerts you when the scripts on your payment pages change.
- Use hosted payment fields where you can. Payment pages or fields served directly by the payment processor keep card numbers out of your page’s reach.
What this means for your company
Every tool you add to your website, even one as harmless-sounding as a visitor counter, is code that runs in your customers’ browsers. If that tool or the server it runs on is compromised, the attacker gets the same access. Keep an up-to-date list of the scripts on your site, keep anything you host yourself patched, and hold your e-commerce and marketing vendors to the same standard. If you take payments, a short review of your checkout page is one of the best security investments you can make this quarter.
Want a clear picture of every script that runs when your customers check out? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
