Magecart Hijacks Convertr Analytics Script: How One Compromised SDK Exposed Shoppers Across Dozens of Brazilian Fashion Brands
In October 2026, a Brazilian Magecart-affiliated threat group compromised Convertr, a Brazilian e-commerce platform processing over R$2 billion in annual sales, by exploiting CVE-2026-8467—an unauthenticated remote code execution vulnerability in an outdated Plausible Community Edition analytics installation. Beginning October 24, attackers injected a payment card skimmer into the shared Plausible tracker script loaded by checkout pages across all Convertr-powered merchants. The skimmer harvested card numbers, expiration dates, CVV codes, cardholder names, and Brazilian CPF tax IDs before exfiltrating them to attacker-controlled infrastructure. Convertr removed the malicious code and patched Plausible by October 27, but all shoppers transacting during the exposure window were advised to cancel their cards immediately. This incident exemplifies the accelerating Magecart supply-chain skimming trend, where a single compromised shared script propagates theft across an entire merchant ecosystem simultaneously. As e-commerce platforms consolidate checkout infrastructure, attackers gain outsized returns by targeting the shared layer rather than individual stores—a tactic that evades merchant-level security controls entirely.
Kill Chain
