Poisoned Pipeline / Incidents / AS335
A Brazilian Magecart group appended a card skimmer to Convertr's own Plausible analytics script, skimming every merchant checkout
Sansec published this on 26 October 2026. From 24 October, checkouts on
Convertr sent shoppers' card details and CPF numbers to 1x0.is. Convertr
hosts the online stores and checkout for dozens of Brazilian fashion
brands, which it says have sold more than R$2 billion (about EUR 320
million) through the platform. Every one of them loads a tracker from
analytics.convertr.app.br, Convertr's own Plausible analytics server. The
attacker appended a skimmer to that one file, so every Convertr checkout
loaded it. Sansec notified Convertr and received no response; at 15:34 UTC
on 26 October the skimmer was still being served.
Plausible is an open-source alternative to Google Analytics that Convertr
runs from the Community Edition on its own server. The infected tracker is
the stock Plausible script followed by an obfuscated block of character
codes that is decoded and run with eval. It activates only on
checkout.convertr pages: it reads the card number, expiry, CVV, cardholder
name and CPF from the payment form and from the requests the checkout sends
to its payment API, and when the shopper places the order it posts the lot
to 1x0.is. The record is pipe-delimited, base64-encoded, sent with fetch in
no-cors mode with keepalive set, and ends in the tag ctr. The attacker
revised it within two days: the 24 October build matched generic field
patterns, and the 26 October build targets the exact field names of the
Convertr payment API. The CPF is the Brazilian taxpayer number, which
Brazilian checkouts ask for with card payments and which banks use to
identify their customers.
Sansec suspects, but cannot confirm, that the entry point was
CVE-2026-8467 in Plausible CE. Convertr installed version 3.0 in 2025 and
never updated it; 3.0.0 through 3.2.0 let anyone run commands on the server
through a component library exposed at /storybook without a login. Plausible
fixed it in 3.2.1 in May 2026. Sansec has not seen Convertr's server logs.
Plausible serves the tracker from a file on disk, so whoever changes that
file infects every site that embeds it.
The group is the Brazilian Magecart operation Sansec has tracked since July
2024 across dozens of Magento, OpenCart and WooCommerce stores, almost all
in Brazil, some of which ran its skimmer for nearly two years. Until now it
hacked stores one at a time; Convertr is the first supply-chain attack Sansec
has seen from it. A day earlier the same 1x0.is/ws endpoint appeared in a
skimmer on another Brazilian store. Its fingerprints have not changed since
2024: a pipe-delimited card number, month, year, CVV, CPF and name ending in
a short victim tag, exfiltration endpoints with Portuguese names such as
cartao.php and pagamento.php, short three-letter .is domains rotated every
few months, some builds posting to Discord webhooks or to scripts planted on
other hacked stores, and dedicated skimmers for e.Rede, PagSeguro, Pagar.me
and Mercado Pago plus a variant that swaps the PIX payment QR code for the
attacker's own. Browsers cache the infected script for up to 24 hours, so
shoppers stay exposed that long after a cleanup.
Mapped techniques
- T0205 Compromise third-party CDN or hosted web asset
- T0180 Compromise services / servers
- T0194 Outdated software components
- T0122 Vulnerability in third-party CI/CD actions
- T0121 Compromised legitimate artifact
- T0159 Malicious artifact execution
- T0207 Skip or forge artifact integrity verification
- T0201 Customers compromised
supply-chain Convertr analytics server
analytics.convertr.app.br serves the Plausible tracker that every
Convertr merchant checkout embeds. Changing one file on that host
put the attacker's code in front of all of them, with no merchant
deploy and no change to any store's own source.
The compromised service is Convertr's own analytics server, not a
package registry. Plausible serves the tracker as a file on disk,
so write access to that file was the whole attack. Sansec could not
confirm the entry point because it did not see the server logs.
Convertr installed Plausible CE 3.0 in 2025 and never updated it.
The flaw Sansec suspects was fixed in 3.2.1 in May 2026, five
months before the skimmer appeared.
CVE-2026-8467: versions 3.0.0 through 3.2.0 run commands on the
server through a component library exposed at /storybook without
authentication. Sansec lists it as the suspected entry point and
says explicitly that it is unconfirmed.
The stock Plausible script kept its URL, its name and its
consumers. The obfuscated character-code block appended after it,
decoded and run with eval, is the only difference, and it fires
only on checkout.convertr pages.
post-supply-chain Convertr merchant checkouts and their shoppers
Every Convertr merchant checkout loaded the tracker from the
platform's analytics host, so the skimmer ran in the checkout
origin of each brand's store rather than in an attacker page.
The tracker was hotlinked from Convertr's server with no
Subresource Integrity to fail when the bytes changed, and browsers
cached the infected copy for up to 24 hours. Sansec's advice to
merchants is to diff priv/tracker/js/ against the official Plausible
release.
What left the checkout was the shopper's card number, expiry, CVV,
cardholder name and CPF, posted to 1x0.is when the order was
placed. Sansec's practical advice is for anyone who paid by card on
a Brazilian store since 24 October where the payment page contained
checkout.convertr to block and replace the card.
Framework gaps noted
- The skimmer reads both the payment form and the checkout's own payment-API requests. That combination is what makes the 26 October build accurate against Convertr's field names; no technique separates reading a form from reading the API traffic of the page that renders it.
- Exfiltration here is a first-party fetch to 1x0.is with no-cors and keepalive. The catalogue has no separate technique for beacon-style card exfiltration from a hijacked analytics script, so T0201 carries the outcome and T0159 the execution.
- The attacker revised the payload twice in two days, tightening field matching after the first build. Not mapped; it is refinement, not a distinct stage.
- CVE-2026-8467 is the suspected, unconfirmed entry point. It is mapped as T0122 and T0194 with that caveat, not as a confirmed initial access.
- The group's other work — one-at-a-time Magento, OpenCart and WooCommerce store compromises since July 2024, and the separate Brazilian store using the same 1x0.is/ws endpoint a day earlier — is context for attribution, not part of this supply-chain event.