Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack
Do Son 
TL;DR
On October 24, 2026, a Brazilian Magecart group launched a Convertr supply chain attack by poisoning the ecommerce platform’s self-hosted Plausible analytics script. Consequently, dozens of Brazilian fashion stores loaded a credit card and taxpayer ID skimmer across their checkout pages. Furthermore, this Plausible Convertr supply chain attack remained active on October 26 after the vendor failed to respond to security alerts.
Delivery and Attribution
Convertr powers online storefronts for dozens of Brazilian fashion retailers that state they have processed over R$2 billion (roughly EUR 320 million) in total sales. Every merchant store loads a visitor tracking script from Convertr’s self-hosted Plausible Community Edition 3.0 server, which was installed in 2025 and never updated. While confirmed attribution does not apply to the initial server breach because researchers lacked server logs, suspected attribution points to CVE-2026-8467. Patched by Plausible in May 2026, this flaw allows unauthenticated remote command execution through an exposed Storybook component library path.
Meanwhile, confirmed attribution links the skimmer code to a Brazilian Magecart cluster tracked since July 2024. According to the Sansec research report, “Until now, the group hacked stores one at a time. Convertr is the first supply chain attack we have seen from it.” Previously, the gang infected dozens of individual Magento, OpenCart, and WooCommerce shops across Brazil, sometimes swaps PIX QR codes, and targets PagSeguro, Pagar.me, e.Rede, and Mercado Pago.
Infection Chain
Because Plausible serves its tracker directly from disk, modifying a single JavaScript file infected every downstream store in the Convertr supply chain attack. Attackers appended an obfuscated array of character codes to the legitimate tracker and executed it using the JavaScript eval function. The script checks the page URL and activates only on official Convertr checkout pages. While the October 24 version used generic form selectors, the attackers updated the script on October 26 to target the exact field names of the Convertr payment API.
Command-and-Control and Exfiltration
When a shopper submits an order, the Plausible Convertr supply chain attack captures the card number, expiration date, CVV, cardholder name, and Brazilian CPF taxpayer number. As Sansec noted, “The CPF is the Brazilian taxpayer number. Brazilian checkouts ask for it with card payments. Banks also use it to identify their customers.” Next, the script formats the stolen values into a pipe-delimited string ending with a short victim tag, encodes the payload in Base64, and sends it via a POST request to a short three-letter Icelandic domain.
Defense and Detection Guidance
Shoppers who paid on a Convertr checkout page since October 24, 2026, should block and replace their payment cards and monitor their CPF numbers for identity fraud. Merchants using the platform must verify that the tracker script is clean, keeping in mind that web browsers cache the poisoned file for up to 24 hours. Finally, administrators running self-hosted Plausible Community Edition must upgrade to version 3.2.1 or later, check access logs for Storybook requests, rotate server secrets, and verify tracker files against official releases.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
