Security notice
Card skimmer hidden in a checkout analytics script. Self-host Plausible? Update and check today.
On October 26, 2026, security firm Sansec reported that a Brazilian card-skimming group hid code in the analytics script that Convertr, a Brazilian online store and checkout platform, loads on its checkout pages. Sansec says that from October 24 the code sent shoppers' card numbers, security codes and CPF taxpayer numbers to an address the attackers control, 1x0[.]is. On October 27, Convertr said it had removed the malicious code, updated the analytics component and replaced credentials it identified as potentially exposed, and that it is working with merchants and payment providers. Sansec suspects the attackers got in through a flaw in Plausible, the self-hosted analytics tool Convertr runs, but neither Sansec nor Convertr has confirmed that. If you run Plausible Community Edition yourself, update it and check your logs today. If you run an online store, find out which outside scripts load on your checkout pages.
What happened
- What Sansec reported. Sansec says a Brazilian "Magecart" group, a name for criminals who steal card details from checkout pages, which Sansec has tracked since July 2024, added a block of scrambled code to the Plausible tracker file that Convertr serves from its own analytics server. Sansec says every Convertr checkout loads that file, and that Convertr runs online stores and checkouts for dozens of Brazilian fashion brands. (Sansec, BleepingComputer)
- What the code does, according to Sansec. It only switches on for Convertr checkout pages. It reads the card number, expiry date, security code, cardholder name and CPF, which is the Brazilian taxpayer number that Sansec says banks also use to identify customers. When the shopper places the order, it sends the details to 1x0[.]is. Sansec says the attackers changed the code within two days: the first version, seen on October 24, used generic patterns, and by October 26 a new version targeted the exact field names of Convertr's payment system. Do not visit that address. (Sansec, BleepingComputer)
- Timeline, according to Sansec. Sansec says the last clean copy of the file it saw was early on October 24 and that it detected the skimmer later that day. It says it told Convertr and had no reply before it published on October 26, and that Convertr was still serving the skimmer on October 26. (Sansec)
- What Convertr says. In a notice dated October 27, written in Portuguese and translated here by us, Convertr says it identified a security incident involving the analytics script used on its checkout pages. Citing Sansec's published findings, it says malicious code was inserted that could capture data shoppers entered at payment, including card data and CPF, and send it to third parties. It says that the code sitting in an analytics component does not rule out exposure of what was typed at checkout. It lists these steps: removing the malicious code, updating the analytics component to a fixed version, and replacing credentials identified as potentially exposed. It says the script was later confirmed clean by the company running the technical investigation, that it is still investigating and assessing the risk to the people affected, and that it is acting with merchants and payment providers as applicable. Sansec reports that it checked the tracker on the morning of October 27 and found it clean. (Convertr's notice, Sansec)
- What Convertr has not said. Its notice does not give the number of merchants, shoppers, cards or purchases affected, how long shoppers were exposed, or how the attackers got in. We did not find a statement from Convertr on those points. BleepingComputer says it asked Convertr for a statement and had no reply when it published. (Convertr's notice, BleepingComputer)
- The suspected way in is not confirmed. Sansec says Convertr installed Plausible Community Edition 3.0 in 2025 and never updated it, and it suspects CVE-2026-8467, a flaw that lets anyone run commands on a Plausible server through a web address called /storybook. Sansec says it has not seen Convertr's server logs and cannot confirm this. BleepingComputer says the same. Convertr's notice does not say how the attackers got in. (Sansec, BleepingComputer, Convertr's notice)
- The Plausible flaw itself is real. Separately from Convertr, Plausible's own notes say that Community Edition versions 3.0.0 through 3.2.0 expose /storybook and that, in those versions, an unauthenticated visitor can run code on the server. It fixed this in version 3.2.1, released May 15, 2026, and rates its advisory Critical, 9.5. Plausible says that if you cannot update right away you can block /storybook at your web proxy or firewall. The flaw is not on CISA's list of known exploited flaws as of its latest version, dated October 27, which we checked on October 28. We did not find a public report of it being used against any other Plausible server. (Plausible release notes, Plausible security advisory, CISA KEV)
Who should worry
- You run an online store or checkout on Convertr.
- You paid by card on a Brazilian online store since October 24. Sansec's test is whether the payment page address contained "checkout.convertr".
- You or your developer host Plausible Community Edition yourself, versions 3.0.0 to 3.2.0, or any other analytics or tracking tool on a server you run.
- Your store loads any script from an outside server, such as analytics, chat or advertising, on its cart or payment pages.
- An agency or developer runs your store and you are not sure what loads at checkout. Ask.
A script on a checkout page can read what shoppers type, so whoever controls that script, or the server it comes from, can see card details. That is why this attack aims at the script instead of the store itself. It is the same reason any outside script on a payment page deserves a second look. (Sansec)
What to do now
Do these today.
- Ask the question. Send the message below to your developer, agency or host. You need clear answers: do we host our own analytics, which scripts load on our checkout, and who controls each one?
- Plausible Community Edition self-hosters: update. Plausible says to move to version 3.2.1 or later, and to block /storybook at your web proxy or firewall until you can. Both Plausible and Sansec say to search your web server logs for requests to /storybook. If you find any, Plausible says to assume the container was compromised and replace every secret it could reach. Sansec adds to rebuild the server and compare the tracker files in its
priv/tracker/js/folder with the official release. (Plausible release notes, Plausible security advisory, Sansec) - Check what your analytics server actually serves. If you host the tracker file yourself, ask your developer to compare it with the official copy and to look for added code. This is our advice. A changed tracker file on a server you control reaches every page that loads it.
- Stores on Convertr: ask Convertr and your payment provider. Sansec says to ask Convertr to confirm the tracker script is clean and to tell your payment provider. Convertr says it is working with merchants and payment providers, so ask what it has told them about your shoppers. (Sansec, Convertr's notice)
- Stores in general: list every script on your checkout. Include scripts from servers you run yourself. Remove any that does not need to be on the payment step, and ask your developer whether a Content-Security-Policy, a browser setting that limits which outside scripts a page may load, can restrict the rest. This is our advice. Sansec says the same group also attacks Magento, OpenCart and WooCommerce stores directly and recommends its eComscan tool for checking a store. (Sansec)
- If you shopped on a Brazilian store since October 24 and the payment page address contained "checkout.convertr": Sansec advises asking your bank to block and replace the card, and watching for fraud that uses your CPF. BleepingComputer reports the same advice. We cannot tell you whether your card was exposed, and neither Sansec nor Convertr has said how many were. (Sansec, BleepingComputer)
- Shoppers: use a fresh browser view. Sansec warned that browsers could keep the infected script for up to 24 hours after the cleanup, and BleepingComputer says to clear your browser cache before ordering again. BleepingComputer also notes that disposable virtual cards, which expire after one purchase, are one way to protect card details when shopping online. (Sansec, BleepingComputer)
What to send your developer, agency or host
On October 26, 2026, Sansec reported that criminals hid a card skimmer in the analytics script that the Brazilian platform Convertr serves to its checkout pages, and Convertr confirmed an incident on October 27. Sansec suspects the attackers got in through CVE-2026-8467, a flaw in self-hosted Plausible Community Edition 3.0.0 to 3.2.0, but that is not confirmed. Please tell me today: do we run Plausible Community Edition or any other analytics we host ourselves, and which version? If it is below 3.2.1, please update it, search the logs for requests to /storybook, and compare the tracker files with the official release. Please also list every script that loads on our cart and payment pages, who controls each one, and whether any can be removed from the payment step. If we sell through Convertr, please confirm with Convertr and our payment provider that the tracker is clean and ask what they know about our shoppers. Tell me what you find. Sources: Sansec, Convertr notice, Plausible advisory.
Common questions
Was my store or business hacked?
This notice does not mean your store was affected. The attack described by Sansec is on Convertr's analytics script, which Sansec says Convertr's merchants all load. Convertr has not published how many merchants or shoppers were affected. It means you should find out which scripts run on your own checkout and, if you host Plausible yourself, update it.
Can EverThread tell me if I am affected?
No. EverThread checks your home page from the outside, the way a browser sees it. We do not test for this. We do not load your checkout or payment pages, we cannot see which scripts run once a shopper starts to pay, and we cannot see your analytics server or its version. A clean EverThread result does not mean your checkout is clean. Your developer or payment provider can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
Was my card exposed?
We cannot tell. Sansec says the code sent card details from Convertr checkout pages from October 24, and Convertr says exposure of what shoppers typed is not ruled out. Neither says how many cards. If you paid on a Brazilian store whose payment page address contained "checkout.convertr", Sansec advises asking your bank to block and replace the card. (Sansec, Convertr's notice)
Is it confirmed that Plausible was the way in?
No. It is Sansec's suspicion. Sansec has not seen Convertr's server logs, and Convertr has not said how the attackers got in. The Plausible flaw is real and fixed in 3.2.1, but whether it was used against Convertr is not established. (Sansec, Convertr's notice)
Where can I follow official updates?
Convertr's security notice is its own account. Sansec's research post has the technical details and has been updated since publication. Plausible's security advisory covers the self-hosted fix.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Sansec: Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install, October 26, 2026, updated October 27, 2026, checked October 28, 2026
- BleepingComputer: Hackers hijack Convertr analytics script to steal payment card data, Bill Toulas, October 27, 2026
- Convertr: Comunicado sobre incidente de seguranca no checkout da Convertr (in Portuguese), October 27, 2026, checked October 28, 2026
- Plausible: Community Edition v3.2.1 release notes, security update, May 15, 2026
- Plausible: Unauthenticated remote code execution via /storybook endpoint (GHSA-mhcv-h7gf-57cf), June 3, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 27, 2026, checked October 28, 2026