Shoppers at dozens of Brazilian fashion brands handed their card details to criminals this month. They clicked nothing suspicious. The Convertr card skimmer sat inside an analytics file that every store on the platform already trusted and loaded on its own payment page. From October 24, those checkouts copied card numbers, security codes and taxpayer IDs, then shipped them to a server run by a Magecart crew.
One file infected every checkout
Convertr runs the storefronts and checkout systems of dozens of major Brazilian fashion labels. Merchants on it have booked over R$2 billion in sales. Every one of those stores pulls a tracking script from the same address, which Convertr operates itself. The attacker never broke into a single shop.
Editing one shared file put a card skimmer on Convertr checkouts across the entire platform. The tracker is a self-hosted copy of Plausible, the open source analytics package many firms run in place of Google Analytics. Plausible serves that script straight from disk, so anyone who rewrites the file controls what loads everywhere. The design is efficient, but one compromise cascades outward instantly.
What the Convertr card skimmer collected
The malicious code stayed dormant on ordinary pages. It woke up only when the browser address contained the string checkout.convertr. At the payment step it read the card number, expiry date, CVV, cardholder name and CPF from the form fields. It watched the requests heading to Convertr’s payment API too.
The CPF deserves a word for anyone outside Brazil. It is the national taxpayer number, and local checkouts ask for it alongside card payments. Banks use it to identify account holders too, so a stolen CPF beside a full card record gives fraudsters a far stronger hand.
Everything went to a server at 1×0.is, base64 encoded and tagged with a short victim marker. Researchers watched the Convertr card skimmer sharpen fast. The October 24 build matched payment fields using generic patterns. Two days later a fresh version aimed at the precise field names inside Convertr’s payment API.
A Magecart group that finally moved upstream
Sansec has tracked this crew since July 2024. Over that stretch it infected dozens of Magento, OpenCart and WooCommerce stores, almost all of them Brazilian. Some victims carried the code for close to two years. Until now the group worked store by store.
Convertr marks its first supply chain attack, and the arithmetic explains the appeal: one compromised platform reached more checkouts in a single afternoon than two years of picking off individual shops ever did. The Convertr card skimmer handed the group reach it never had. Its fingerprints stayed put, from Portuguese named endpoints such as cartao.php to the short three letter .is domains it rotates every few months.
Built for Brazilian payment rails
The crew tailors its tooling to local habits, with dedicated skimmers for e.Rede, PagSeguro, Pagar.me and Mercado Pago. One variant replaces the PIX payment QR code with one the attacker controls. That turns an instant bank transfer into a straight donation. The Convertr card skimmer fits the same pattern of patient local expertise.
An analytics server nobody updated
Researchers suspect the attackers walked in through CVE-2026-8467, a critical flaw in Plausible Community Edition 3.0.0 through 3.2.0. The bug let anyone run commands through a component library exposed at /storybook with no login. Convertr put version 3.0 in place during 2025 and left it there, though Plausible shipped a fix in May 2026.
That gap matters well beyond this one incident. Analytics servers rarely reach a patch schedule, because teams file them under marketing rather than security. The Convertr card skimmer exploited exactly that blind spot. Nobody has confirmed the entry point, though, because outside researchers never saw the logs.
What shoppers and merchants should do now
The Convertr card skimmer only fired on pages whose address contained checkout.convertr. Shoppers who used a card at a Brazilian store after October 24 should check that address. If it matches, ask the bank to cancel the card and issue a new one, then watch for fraud tied to the CPF as well.
Convertr cleaned the tracker on October 27 and upgraded Plausible. Even so, the skimmer stayed live in browser caches for up to 24 hours after the fix, leaving shoppers exposed past the cleanup. Merchants should get written confirmation that the script is clean, then tell their payment provider directly.
The Convertr card skimmer began with an unpatched analytics server, so self-hosted Plausible users should act too. Upgrade Community Edition to 3.2.1 or later now. Searching access logs for requests to /storybook comes next, and any hits mean rebuilding the server and rotating its secrets.
Why shopper side defenses fell short
Nothing visible would have warned a careful customer. The padlock was there, the certificate checked out and the store was genuine. Browser warnings and reputation filters need something to look wrong, and here nothing did. A VPN keeps a network operator or a public Wi-Fi snoop out of the session, yet it cannot inspect what a trusted checkout page runs inside the browser.
So protection shifts toward limiting what a compromised page can take. Disposable virtual cards expire the moment a transaction clears, which turns stolen details into useless digits. Instant alerts and low online limits also shrink the damage. A dedicated e-commerce card helps too, because the Convertr card skimmer could only take what the checkout received.
Final Thoughts
Supply chain compromises keep working because trust runs one way and nobody audits it backwards. A merchant trusts its platform. That platform trusts its analytics server, and the server trusts a file sitting one unpatched bug away from anybody. The Convertr card skimmer turned that quiet chain into a single point of failure for dozens of brands.
Cleanup moved fast once the research went public. Still, three days passed between the first infected page load and a confirmed clean tracker, and every card typed into a Convertr checkout during that window now sits in criminal hands. The lesson is narrow. Assuming any checkout can fail changes what you are willing to type into one.
