Convertr Supply Chain Attack Breaches Brazilian Stores
A solitary compromised file allowed cybercriminals to harvest credit card data across dozens of prominent Brazilian retailers. Specifically, the malicious actors embedded an invisible digital skimmer inside a routine analytics script. The infected script loaded automatically whenever shoppers finalized purchases online. Consequently, the Convertr supply chain attack transformed a standard tracking tool into an expansive card-stealing pipeline.
Targeting Shared Infrastructure Across Fashion Brands
The targeted platform, Convertr, provides specialized e-commerce infrastructure for prominent fashion retail brands across South America. Notably, corporate records show the provider has processed over two billion Brazilian reals in customer transactions. Rather than breaching individual merchant storefronts, the hackers altered a shared JavaScript resource hosted on analytics.convertr.app.br. Therefore, malicious execution code infiltrated the payment interfaces of every connected storefront simultaneously.
The compromised resource belonged to Plausible Community Edition, an open-source analytics platform self-hosted by Convertr. Malicious operatives appended an obfuscated payload disguised as encoded numeric values. When a web browser rendered the checkout interface, it reconstructed and executed the malicious instructions. Crucially, the skimmer activated exclusively on URLs containing checkout.convertr. Consequently, standard browsing sessions outside the checkout funnel displayed zero anomalous behavior.
Exfiltration Tactics and Threat Actor Attribution
The digital skimmer covertly harvested credit card numbers, expiration dates, security verification codes, cardholder names, and national tax identifiers. Furthermore, the malware intercepted parameters submitted through checkout forms and payment API requests. After completing the order, the script transmitted the stolen data to an external collection server at 1×0.is. Analysts identified the initial iteration of the script on October 24. Subsequently, the threat group updated the code on October 26 to target specific Convertr data fields.
As highlighted in a comprehensive security report from Sansec, researchers linked the operation to an established Brazilian threat syndicate. Previously, this criminal group compromised standalone installations of Magento, OpenCart, and WooCommerce. In this instance, however, the perpetrators adopted a centralized supply-chain methodology to maximize their operational yield.
Plausible Vulnerability and Remediation Measures
Investigators suspect the attackers gained initial server access by exploiting CVE-2026-8467. This severe vulnerability affects Plausible Community Edition versions 3.0.0 through 3.2.0. Specifically, an unauthenticated component within /storybook permitted remote command execution on the underlying hosting server. Although developers patched the flaw in May 2026, Convertr continued operating the vulnerable build.
Convertr purged the skimmer and upgraded its analytics instance on October 27. Additionally, the company initiated notifications to impacted merchants and payment processing partners. However, browser caches may have retained the infected script for twenty-four hours after server remediation. Therefore, affected Brazilian shoppers should contact their banking institutions promptly to request card replacements.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
