A Brazilian Magecart group hid a card skimmer inside the analytics script that Convertr loads on every merchant checkout, Sansec reported on October 26.
Convertr is a Brazilian platform, so most readers of Ecommerce Paradise are not on it. The method is what travels: one tampered file, loaded by every merchant, running on the page where shoppers type card numbers. If your store loads scripts from outside vendors, and every store does, this is your risk model.
Below is what Sansec found, the likely way the attackers got in, what it means for a high-ticket store like the ones in my guide to high-ticket dropshipping, and a six-step audit you can finish this week.
Form your LLC with Northwest Registered Agent so your store runs under a company, not your personal name. It is the formation service I point ecommerce owners to, and unlike cheap formation sites that upsell, the renewal price stays what you paid in year one. Form your LLC with Northwest →
Convertr Checkout Skimmer Ran Oct. 24 to Oct. 27
Convertr runs the online stores and checkouts of dozens of Brazilian fashion brands, according to Sansec’s forensics report. Sansec says merchants on the platform have sold more than R$2 billion through it, about €320 million. BleepingComputer, in its own write-up of the incident, converts the same figure to roughly $370 million.
Convertr hosts Plausible Community Edition, an open-source analytics tool, on its own server. Every merchant loads the tracker from one address, analytics.convertr.app.br. Per Sansec, the attacker modified that single file by appending obfuscated character codes that decode and run through eval.
The skimmer only activates on checkout.convertr pages. It collects the card number, expiry date, CVV, cardholder name and the CPF, Brazil’s taxpayer number, from the payment form and from the checkout’s payment API requests. It sends the data as a base64-encoded record to a server at 1×0.is.
The timeline, all in UTC per Sansec:
Sansec last saw a clean copy of the tracker at 05:03 on October 24 and detected the skimmer at 23:22 the same day. On October 26 the attacker pushed a second version that targeted the exact field names of Convertr’s payment API instead of generic patterns. At 15:34 that day Convertr was still serving it.
Sansec says it notified Convertr before publishing and got no response. On October 27 at 12:54, Convertr reported that it had removed the skimmer and upgraded Plausible, and Sansec confirmed the tracker clean at 13:08. Convertr also said it is notifying affected merchants, payment providers and authorities.
Three things are still unknown. Neither Sansec nor BleepingComputer gives a count of affected stores or stolen cards. The entry point is a suspicion, not a finding. And browsers can cache the infected script for up to 24 hours, so exposure ran past the cleanup.
Convertr’s Suspected Entry Point: An Unpatched Plausible Server
Sansec suspects CVE-2026-8467, a flaw in a component called phoenix_storybook that ships inside Plausible. Per the vulnerability database entry at Mend.io, unauthenticated clients can send input that gets compiled and executed, which is remote code execution. It carries a CVSS v4 score of 9.5 and a v3 score of 10, and it was published May 20, 2026.
Plausible fixed it in Community Edition 3.2.1 in May, per Sansec’s timeline. Convertr installed version 3.0 in 2025 and never updated it. Sansec has not seen Convertr’s server logs, so the link between the flaw and the break-in is unconfirmed.
The group is not new. Sansec has tracked it since July 2024 and says it has infected dozens of stores running Magento, OpenCart and WooCommerce, almost all in Brazil. Some ran its skimmer for nearly two years. Convertr is its first supply-chain attack, meaning it hit one vendor to reach many merchants instead of breaking into stores one at a time.
The group rotates its collection servers often. Sansec lists 14 earlier exfiltration domains, mostly short .is addresses, plus six Discord webhook IDs, which means blocking one address does little.
The group’s toolkit includes skimmers built for the Brazilian processors e.Rede, PagSeguro, Pagar.me and Mercado Pago, plus a variant that swaps the PIX payment QR code for its own, per Sansec.
There is a real counterpoint for US store owners. Convertr’s merchants are Brazilian, the stolen data includes a Brazilian ID number, and Sansec’s advice to cardholders is limited to Brazilian stores. Shopify also says in its pixels documentation that app and custom pixels run in a secure sandbox restricted to the data made available inside it. And the PCI Security Standards Council says merchants that use an embedded payment iframe from a compliant provider can lean on that provider for script protection.
None of that makes the pattern irrelevant. It means your direct exposure depends on where your scripts run and who patches the server behind them.
This is not the first supply-chain scare I have covered for store owners. Shopify asked app developers to harden their apps after hijacks, which I wrote up in the Shopify app security guidance post. The Railway breach put store API keys at risk.
Stolen keys also backdoored WordPress stores through UpdraftCentral. Different vendors, same shape: the store owner did nothing wrong, and a tool they trusted did.
What Third-Party Scripts Mean for Your Store’s Checkout Risk
My read is that the lesson is not “Brazil has a problem.” The lesson is that a checkout page is only as safe as the least-maintained server it pulls a file from.
Count what your store loads. A typical Shopify store runs a Meta pixel, Google tags, an email platform, a reviews widget, a chat widget and a handful of app scripts. Each one is a file on someone else’s server, and each vendor is a Convertr waiting to forget an update. Every dropshipping app you install, from a supplier connector like the one in my Spocket setup walkthrough to a loyalty widget, adds a line to that list.
Here is hypothetical math to size it, not a reported figure. Say your high-ticket store takes 15 card orders a day at a $2,400 average. A three-day window like Convertr’s puts 45 cardholders and $108,000 of orders in front of a skimmer. That is 45 notifications, 45 cards to replace, and a stack of disputes at ticket sizes where a single one costs more than a month of software.
High-ticket is the worst case for this attack because the card limits are high and the buyers are typically older and affluent. I covered the dispute side in chargeback prevention for high-ticket stores. The cost keeps climbing, since service disputes already make up 24% of contested chargebacks, per my breakdown of the Justt data.
Here is how I would split the risk by setup.
If you run on Shopify, the checkout itself is hosted and its pixels run in a sandbox, per Shopify’s help center, so your exposure sits in the storefront, cart and any custom pixel code you pasted in yourself. The Shopify sandbox only helps if you keep the pixel list clean.
If you run WooCommerce, Magento or OpenCart, you are in the group’s target list. Sansec says it infects stores on exactly those three. You own the patching, the file integrity and the script list, and my coverage of the PHP2Shell exploitation shows how fast attackers move on unpatched hosts.
If you self-host analytics, such as Plausible or Matomo, treat that server as part of your checkout. It is the Convertr setup. I would apply a hard threshold: any critical vulnerability on a server that serves a script to your checkout gets patched within days, not at the next maintenance window. If nobody on your team will do that, use a vendor-run tool. My comparison of Google Analytics alternatives lays out the options.
Convertr served its tracker from its own subdomain, a first-party-style setup of the kind I covered in the Safari 27.2 cookie cap fix. Trackers served that way are good for measurement and just as good for an attacker, because browsers and shoppers treat the script as part of your site.
Ask every vendor on your script list three questions. Who patches the server that hosts the file? How would you find out if the file changed? How fast do they tell customers after an incident? Sansec says it got no reply from Convertr before publishing, and that silence is the answer I would score lowest.
The PCI angle is worth a plain read. PCI DSS requirements 6.4.3 and 11.6.1, which took effect for e-commerce environments on March 31, 2025, per the PCI Security Standards Council, ask for three things on payment pages: authorize each script, check its integrity, and keep an inventory with a reason for every script. Report URI’s explainer adds that 11.6.1 calls for detecting changes to payment page scripts and security headers. I am not your QSA, and which questionnaire applies to you depends on how you take payments. Ask your processor.
The honest summary of my position: you do not need to fear every pixel, but you do need a list, an owner and a schedule. That is boring operations work, and it is exactly the work most solo owners skip. It is also why I built the turnkey done-for-you build, where my team sets up a high-ticket store on a hosted checkout with a short, deliberate list of apps from day one.
Skip the script sprawl: have my team build a high-ticket store with a hosted checkout and only the apps it needs. See the turnkey done-for-you service →
Six-Step Checkout Script Audit for This Week
This takes an afternoon. Do it before Black Friday traffic arrives, when every checkout minute carries more orders.
- Open your cart and checkout flow in Chrome, press F12, go to the Network tab, filter to third-party requests, and write down every domain that loads a script. On Shopify, also open the Customer events page in your admin settings and list every app pixel and custom pixel.
- Delete anything you do not recognize or have not used in 90 days. Then turn the remaining list into a one-line-per-script inventory with a reason for each, which is what PCI 6.4.3 asks for. I would paste the list into Claude and have it draft the inventory, then check the reasons yourself. If you use a consent banner, a tool like Termly can control which scripts load by category, but it does not replace the inventory.
- If you self-host any analytics, confirm the version. For Plausible Community Edition that means 3.2.1 or later, per Sansec, and a search of your access logs for requests to /storybook. Any hit means rebuild the server and rotate its secrets. If you run WooCommerce, consider a host that patches the server for you. SiteGround sells managed WordPress plans. Cloudways sells managed cloud hosting.
- Email your payment processor and ask two questions: do you supply the payment iframe or hosted fields, and what script monitoring do you provide for the checkout page? Keep the reply on file. My guide to small business payment processors covers who offers what. The piece on building a backup payment plan covers the other half of this conversation.
- Add a fraud net so one bad day does not become a chargeback pile. A screening service such as ClearSale is one option. My notes on fraud detection methods for ecommerce list the rest.
- Put a monthly 30-minute recheck on a calendar and hand it to a virtual assistant with a written checklist. You can hire one through OnlineJobs.ph. If you want a second set of eyes on your store setup, Explore Turnkey Builds and we will go through it together.
My broader checklist for hardening a growing store is in protecting your high-ticket store as you scale. I covered how to put AI to work on the rest of the stack in Claude for ecommerce.
Frequently Asked Questions
Does the Convertr attack affect my Shopify store?
There is no sign it does. Sansec reports the skimmer ran on Convertr checkouts and the stolen fields include a Brazilian taxpayer number. The same method can hit any store that loads a script from a vendor-run server, so the audit above still applies.
What is Magecart?
It is the name for groups that inject JavaScript into checkout pages to copy card details as shoppers type them. The Convertr group is a Brazilian crew tracked by Sansec since July 2024.
Are self-hosted analytics tools riskier than hosted ones?
They shift the patching job to you. A vendor-run tool has someone else updating the server, while a self-hosted one is only as safe as your last update. Convertr’s tracker server ran an old Plausible version, per Sansec.
What do PCI DSS 6.4.3 and 11.6.1 require?
Per the PCI Security Standards Council, they require merchants to authorize payment page scripts, verify their integrity and monitor for tampering. Which requirements apply to you depends on how you take cards, so confirm with your processor.
How do I know if my store already has a skimmer?
Compare your live script list against your inventory, scan your site with a malware scanner such as the eComscan tool Sansec offers, and watch for customers reporting fraud after buying from you. My coverage of the PHP2Shell patch gaps shows why a clean scan today does not settle it.
I do not have a store yet. What should I set up first?
Pick a niche before you pick apps. Grab my free high-ticket niches list to start. Then read the full high-ticket niches breakdown and keep your first store’s app list short.
Work through store security and setup with other owners, and with me, inside the community. Join the Skool community →
Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day. I wish you the best of luck out there, and go check your script list today.
Related Articles
If this was useful, these go deeper:
- Adobe Commerce BlockStrap Flaw Is a 10.0: Patch Now
- Some Rank Math PRO Downloads Carried a Backdoor
- Ninja Forms Flaw Plants Hidden Admins on WordPress Stores
- The AI Running Your Shop Pay Checkout Had a Security Hole
- Everything You Need to Launch a High Ticket Dropshipping Business in 2026
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
