Brazilian Magecart Group Skims Cards in Convertr Supply Chain Attack

On 24 October 2026, a Brazilian Magecart group launched a supply chain attack against Convertr by poisoning the platform’s self-hosted Plausible analytics script. The infection leveraged Plausible Community Edition 3.0, installed in 2025 and never updated, to load a skimmer across dozens of Brazilian fashion retailers’ checkout pages.

Researchers noted that Convertr serves many stores with reported sales totaling over R$2 billion, and that the attack affected every merchant store loading the compromised Plausible script because Plausible serves the tracker from disk, enabling a single file modification to propagate downstream.

The incident links to CVE-2026-8467, a vulnerability patched by Plausible in May 2026 that allowed unauthenticated remote command execution via an exposed Storybook component library path; attribution to the initial server breach remains inconclusive due to missing server logs, though Sansec later connected a broader Brazilian Magecart cluster to the actors.

In the infection chain, attackers appended an obfuscated array of character codes to the legitimate tracker and used JavaScript eval to execute it, activating only on official Convertr checkout pages. When a shopper submitted an order, the skimmer captured card data (number, expiry, CVV), cardholder name, and Brazilian CPF taxpayer number, formatting them into a pipe-delimited string, Base64-encoded, and exfiltrating to a short Icelandic domain.

Sansec’s research notes that Convertr is the first supply chain attack observed from this group after prior campaigns against individual Magento, OpenCart, and WooCommerce shops. Defence guidance includes merchants upgrading to Plausible 3.2.1+, verifying tracker files, rotating secrets, and monitoring logs for Storybook requests; shoppers are advised to watch for card or CPF fraud and to replace affected payment credentials.