Skip to content
Hacker Posts

Brazilian Magecart crew skims Convertr checkouts via Plausible

Sansec says a Brazilian Magecart group poisoned Convertr's self-hosted Plausible analytics script, skimming card data and CPF numbers from checkouts since 24 October.

Published 3 min read
breachmagecarte-commerceplausibleskimmer

A Brazilian Magecart group planted a payment-card skimmer inside the self-hosted Plausible analytics script used by Convertr, a Brazilian e-commerce platform that handles checkout for dozens of fashion brands and around R$2 billion in sales. According to Sansec's report, published 26 October, every Convertr checkout loaded the poisoned tracker from 24 October, sending card details and CPF taxpayer numbers to the attacker. It is the first supply-chain attack by a crew Sansec has tracked since July 2024, which until now hit individual Magento, OpenCart, and WooCommerce stores one at a time.

How the attack worked

The attacker modified Convertr's self-hosted Plausible tracker — an open-source Google Analytics alternative — at analytics.convertr.app.br/js/script.pageview-props.tagged-events.js. The injected code runs only on pages whose URL contains checkout.convertr, harvests the payment form, and exfiltrates a pipe-delimited record to 1x0.is.

Sansec suspects initial access via CVE-2026-8467, an unauthenticated command-execution flaw in Plausible Community Edition 3.0.0–3.2.0 (an exposed /storybook component), patched in CE 3.2.1 on 15 May 2026. Sansec notes it has not seen Convertr's logs, so this entry vector is unconfirmed. By 26 October the skimmer was upgraded to target Convertr's exact payment-API field names.

Stolen fields: card number, expiry month and year, CVV, cardholder name, and CPF.

Detection artifacts

Sansec published indicators verbatim; the infected tracker's hash and the live exfil host:

SHA-256 (infected tracker, 26 Oct): ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7
Exfiltration: https://1x0.is/ws  and  https://1x0.is/ws/<base64>
Skimmer loader string: _s+=String.fromCharCode(_a[_i]);(0,eval)(_s)
Page gate: indexOf('checkout.convertr')

Sansec also lists earlier exfil domains for the same crew — snf.is, kk.land, nmn.is, kof.one, anl.is, xsox.diy, eqp.is, shy.is, blz.is, tray.is, miorl.net, xwv.is, fasthook.app, antiddos-protection.net — and exfil paths cartao.php and pagamento.php. Convertr says it removed the skimmer and upgraded Plausible; Sansec confirmed the tracker was clean on 27 October.

Action checklist

  1. If you shopped a Brazilian store on a page containing checkout.convertr since 24 October, ask your bank to block and replace the card, and watch for fraud tied to your CPF.
  2. Convertr merchants: confirm with Convertr that the tracker is clean, notify your payment providers, and warn customers — a cached copy of the script can keep skimming for up to 24 hours after cleanup.
  3. Anyone self-hosting Plausible CE: upgrade to 3.2.1 or later, grep access logs for /storybook, and if you find hits, rebuild the host, rotate secrets, and diff priv/tracker/js/ against the official release.
  4. Block the exfil hosts above at the egress proxy and hunt for the loader string in served JavaScript.

Context

Self-hosting the analytics tooling vendors recommend to dodge third-party trackers moves the supply-chain risk in-house rather than removing it: one unpatched component on a shared asset now skims every merchant on the platform. It is the same lesson as every CDN-side Magecart hit, with the twist that the poisoned file was a privacy tool.

Related stories