A Brazilian card-skimming group planted malicious code in a Plausible analytics script that Convertr self-hosts and loads on every merchant’s checkout page, according to Sansec. Convertr runs online stores and checkout for dozens of Brazilian fashion brands, and from October 24 the skimmer took their shoppers’ card numbers, expiration dates, CVVs, names, and CPF taxpayer IDs. Sansec suspects the attackers got in through CVE-2026-8467, a flaw in older Plausible versions that Plausible patched in May, but it can’t confirm that without Convertr’s server logs. The group had only hit individual Magento, OpenCart, and WooCommerce stores before. Convertr cleaned the script and updated Plausible on October 27, but browsers may keep serving the cached malicious file for up to a day afterward.
