A shared analytics script at Convertr, a Brazilian checkout provider, was altered to copy card details. Shoppers who paid there since October 24 should act.
Hackers tampered with a piece of code that loads on the checkout pages of online stores using Convertr, a Brazilian e-commerce platform, and used it to copy card details as shoppers typed them in. Security firm Sansec identified the campaign on October 24. Anyone who paid by card at an affected store should treat that card as exposed.
Convertr runs a tool called Plausible, an open source alternative to Google Analytics, on its own server. Sansec says the attacker changed the tracking file on that server. Because the file loads on the checkout pages of every merchant on the platform, one change reached many stores at once.
This type of attack is called card skimming. Malicious code sits on a checkout page and quietly sends a copy of what you type to the attacker. Sansec says an early version used generic patterns. By October 26, the attackers pushed a sharper version aimed at Convertr's exact payment field names.
The campaign has been tied to a Brazilian gang active since at least July 2024. It usually infects stores running Magento, OpenCart and WooCommerce.
Convertr powers stores and checkout for dozens of major Brazilian fashion brands and handles about R$2 billion ($370 million) in sales. The people most at risk are shoppers who paid by card on a Brazilian store whose checkout address contains "checkout.convertr" since October 24. The merchants using Convertr are affected too.
If you have not paid by card at a Brazilian online store in that time, nothing in the reporting points to you being exposed.
The steps are in the alert box above. The main one is to call your bank, ask it to block and replace the card, and check your statements for charges you do not recognize.
One more detail matters even after the cleanup. Sansec warns that your browser may keep running the bad script for up to 24 hours. Clear your cache before placing new orders. Disposable virtual cards, which expire right after a purchase, also limit the damage if a checkout page is ever compromised.
Sansec says Convertr removed the skimmer and upgraded Plausible to a patched version. Convertr also announced it was notifying affected merchants and payment providers. BleepingComputer asked Convertr for a statement and had not heard back.
Several things are still unknown. Sansec suspects the attackers got in through a flaw tracked as CVE-2026-8467 in Convertr's outdated Plausible software, but that is not confirmed. The material also does not say how many shoppers were hit or exactly when the theft began. Because of that, October 24 is best read as the date it was spotted, so a card used shortly before then is worth a second look.
If you paid by card at a Brazilian online store since October 24, call your bank to block that card, then clear your browser cache before shopping again.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
