Security · Updated 28 Oct, 02:27 am IST
Hackers hijack Convertr analytics script to skim payment cards
Why it matters for readers: It shows how attackers can hide malicious code in legitimate analytics tools to steal payment data without touching payment processors directly.
- Attackers injected malicious code into a Plausible analytics tracker hosted on Convertr’s infrastructure that loads on all merchants’ checkout pages.1
- Sansec attributes the campaign to a Brazil-based group active since at least July 2024 that focuses on Magento, OpenCart and WooCommerce stores.1
- Sansec suspects the intruders exploited an unauthenticated command‑execution flaw (CVE-2026-8467) in Convertr’s outdated Plausible Community Edition to gain initial access, though this is not confirmed.1
- Convertr is a Brazilian e‑commerce platform handling large retail sales and hosts a self-managed Plausible tracker on its servers that was altered by the attackers.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started