Skip to content
Brazilian Hackers Compromise Convertr to Steal Payment Data

Brazilian Hackers Compromise Convertr to Steal Payment Data

First seen 27 Oct 2026, 21:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 01:47 UTC
  • •A Brazilian hacking group compromised Convertr's analytics script to steal payment data.
  • •The attack exploited CVE-2026-8467, a critical vulnerability in Convertr's Plausible installation.
  • •Convertr has removed the skimmer and upgraded its systems, but users should clear their caches.

A Brazilian cybercrime group hijacked an analytics script from e-commerce platform Convertr to steal payment card data and CPF numbers from customers during checkout. The attack was identified on October 24, 2026, and is believed to have exploited CVE-2026-8467, a vulnerability affecting Convertr's outdated installation of the Plausible analytics tool. The attackers injected a skimmer into the Plausible tracker file, which was used by numerous online stores powered by Convertr, affecting potentially millions of transactions. The skimmer was designed to capture sensitive payment information and send it to an external server. Convertr has since removed the skimmer and upgraded to a patched version of Plausible, but users are advised to clear their browser cache to ensure the malicious script is no longer active. Security firm Sansec has been monitoring the situation and confirmed the details of the attack.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-20
CVE-2026-8467 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
Attack identified
A skimmer was found in Convertr's analytics script, capturing payment data from customers.
BleepingComputer
2026-10-26
Skimmer updated
The attackers refined the skimmer to target specific payment API field names used by Convertr.
Sansec
2026-10-27
Convertr removes skimmer
Convertr confirmed the removal of the skimmer and upgraded to a patched version of Plausible.
BleepingComputer

More articles in this cluster (2)

Following this threat?

Track Convertr and CVE-2026-8467 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

Which systems are affected?
The attack affected e-commerce platforms using Convertr, particularly those running the Plausible analytics script.
What should customers do?
Customers who made purchases on affected sites should contact their banks to block their cards.
Is the vulnerability patched?
Yes, Convertr has upgraded to a patched version of Plausible to mitigate the risk.