Convertr Supply Chain Attack: Magecart Skimmer Injected into Plausible Tracker to Steal Payment Data

1. Overview

• Article Name: Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
• Source: Sansec
• Publication Date: 2026-10-26
• Updated Date: 2026-10-27
• Original: Sansec
• Related Sources: BleepingComputer: Convertr supply-chain attack, Plausible CVE-2026-8467 advisory
• Related Malware, Threat Groups, CVEs, Products: Web skimmer, Brazilian Magecart group, CVE-2026-8467, Convertr, Plausible Community Edition
• Severity: Critical

2. Executive Summary

A notorious Brazilian Magecart group injected a web skimmer into the Plausible Analytics script distributed by the Brazilian e-commerce platform Convertr, causing modified trackers to load across merchant checkout pages. The skimmer was designed to steal credit card numbers, expiration dates, security codes (CVV), cardholder names, and CPFs (Brazilian taxpayer IDs) from targeted checkout pages, transmitting the data to the exfiltration endpoint 1x0.is/ws. Note that this does not mean data theft was successfully confirmed for every single buyer. Although the compromised script was removed on October 27, 2026, Sansec has not confirmed that CVE-2026-8467 was the entry point. Sansec had not reviewed Convertr's server logs, so this remains a suspected entry point rather than a confirmed finding.

Sansec reported payment data theft through a shared tracker, illustrating how tampering with one server can affect multiple e-commerce merchants. Because the exploitation of the initial vulnerability remains unconfirmed, verified facts and inferences are clearly distinguished and organized.

3. Attack Flow

Payment Data Theft via Shared Analytics Script

1. An attacker modifies the Convertr Plausible tracker file (identified by Sansec as /js/script.pageview-props.tagged-events.js) and embeds obfuscated web skimmer code.
2. The web browsers of visitors to merchant checkout pages load the modified shared tracker, and the skimmer dynamically extracts card numbers and CPF information from payment input forms and API requests.
3. Base64-encoded payment data records are transmitted directly from the user's browser to the external server 1x0.is/ws.

The following table outlines the attack flow and investigation considerations based on Sansec's analysis and public disclosures. It does not confirm that payment data was stolen from every merchant or all buyers.

Inference: The defender indicators in the table are investigation candidates. Logs, browser telemetry, and Content Security Policy (CSP) violation reports depend on deployment settings and retention scopes.

4. Attacker Positioning and Execution Location

• Positioned to modify tracker files on the Convertr analytics server. CVE exploitation is unconfirmed.

5. Victim and Administrator Perspective

• Victims: Checkout may appear to work normally, making the theft difficult to detect from the page alone.
• Administrators: Investigation leads include changes to third-party script hashes, added obfuscated code or eval, and browser traffic to unexpected .is domains, where the relevant telemetry is available.

6. Success and Failure Conditions

Success Conditions

• The modified tracker is loaded from the browser cache or server.
• The URL matches checkout.convertr, and the user enters payment details and places an order.

Failure Conditions and Mitigations

• Revert the tracker to a clean version and force an update or invalidation of the browser cache. According to Sansec, compromised scripts remain in the cache for up to 24 hours, so server-side removal alone does not immediately eliminate risk for all users.
• Update to Plausible CE 3.2.1 or later and investigate access to /storybook. If such access is found, follow Sansec's procedures to rebuild the server, rotate secrets, and compare tracker files with the official version.
• Inference: Consider implementing Content Security Policy or script integrity verification for checkouts. Domain allowlists alone may not protect against the tampering of already-permitted scripts.

7. What Happens Upon Success

• Theft of card numbers, expiration dates, CVV, names, and CPF.
• Browser-side supply chain compromise simultaneously affecting multiple merchants.

8. Observable Logs

Inference: The following are investigation candidates based on public disclosures and identifiers. The reviewer has not verified on deployed systems which events are logged or which fields are available. Results depend on configuration and log retention, and a single match does not confirm successful compromise.

• Email: No specific email-related indicators identified.
• Proxy / SWG / DNS: Verify POST requests to 1x0.is/ws and script retrieval from analytics.convertr.app.br.
• Endpoint / EDR: Preserve compromised scripts remaining in the browser cache of checkout terminals.
• Identity / IdP: No specific information.
• SaaS / Cloud: Check analytics server /storybook requests, file modifications, and administrative operations.
• Network: Verify the SHA-256 hash ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 of the retrieved script (2026-10-26 sample).

9. Attack Success Determination

• Payment Data Exfiltration — Assessment Criterion: Confirm that a payload containing payment data was sent from a user's browser to 1x0.is/ws. Sansec analyzed the malicious script and its transmission code; this does not establish the number of individual victims.

10. Investigation Playbook

1. Trigger: 1x0.is/ws traffic or tracker hash match
2. Initial Review: Check merchants, timeframes, browser caches, and server logs
3. Endpoint Investigation: Preserve cache and network evidence from victim terminals
4. Identity & Cloud: Check Plausible host access, file modifications, and secret usage
5. Follow-up Operations: Investigate card fraud and whether other merchants received the same compromised tracker
6. Containment: Remove scripts, invalidate caches, patch systems, rotate secrets, and notify stakeholders
7. Distinction of Phases: Distinguish between script delivery, data entry, exfiltration, and financial loss

11. Defense and Detection Ideas

• Single Event: POST requests from checkout pages to unknown .is domains
• Timeline Correlation: Tracker update → Checkout load → Card entry → Exfiltration
• Hunting: Monitor hash discrepancies in shared analytics assets
• Log Gaps: Without browser telemetry, individual exfiltration events are difficult to identify
• Priority Actions: Prioritize Plausible updates and script integrity monitoring

12. Facts, Inference, and Hypothesis

Facts

• From October 24, 2026, Convertr checkouts transmitted card data and CPFs to 1x0.is/ws.
• The skimmer operated only on checkout.convertr, base64-encoding and transmitting card numbers, expiration dates, CVV, names, and CPFs.
• Attackers updated the skimmer on October 26 to match exact Convertr payment API field names.
• Convertr removed the skimmer on October 27, updated Plausible to a patched version, and Sansec confirmed the tracker was clean.
• Sansec was unable to review server logs and has not confirmed whether CVE-2026-8467 was the actual initial access vector.

Inference

• Integrity monitoring for shared analytics scripts must be handled with the same rigor as monitoring the checkout application itself.

Hypothesis

No additional hypotheses. Unverified items are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

There are no actionable mappings with confirmed evidence.

14. Unknowns and Further Investigation

• The number of affected purchases and the scope of impacted merchants.
• Whether CVE-2026-8467 was the actual initial access vector.

15. Impact on SOCs and Organizations

Organizations using cross-border e-commerce or payment services for Brazil should monitor for browser-side supply chain compromises involving third-party tracker tampering and prepare for potential card data and personally identifiable information leaks.

16. Summary by Role

• For SOCs: Investigate scripts originating from analytics.convertr.app.br and browser communications to 1x0.is/ws.
• For Administrators: Update Plausible CE to version 3.2.1 or later, verify tracker file hashes, and check for access to /storybook.
• For Users: If you entered card details on an affected checkout page, contact your financial institution to request a card replacement and monitor for unauthorized activity.