Threat reportSupply ChainTL-2026-4571
Convertr Plausible analytics script hijacked for payment card skimming (CVE-2026-8467)
Convertr Plausible analytics script hijacked for payment (TL-2026-4571), also tracked as Convertr Plausible supply-chain attack, is a high-severity supply-chain compromise scored CVSS 9.5, first published 2026-10-27. It is linked to a Brazil-nexus actor with medium confidence, affects Plausible Analytics Plausible Community Edition (self-hosted, bundles, references 1 CVE (CVE-2026-8467), maps to 6 MITRE ATT&CK techniques (T1056, T1059, T1059.007), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.5/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4571
- Threat ID
- TL-2026-4571
- Also known as
- Convertr Plausible supply-chain attack
- Severity
- HIGH
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Brazil
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, fashion, finance
- Target regions
- brazil
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Convertr Plausible analytics script hijacked for payment
Malware and tooling: Convertr Plausible skimmer, magecart
How Convertr Plausible analytics script hijacked for payment works
A Brazilian Magecart-style gang, active since at least July 2024, planted a card skimmer in the Plausible analytics script served by Brazilian e-commerce platform Convertr, harvesting card numbers, expiry dates, CVVs, cardholder names and CPF taxpayer IDs from dozens of merchants' checkouts from 2026-10-24. Initial access is suspected (unconfirmed) via CVE-2026-8467, an unauthenticated remote code execution flaw in Convertr's never-updated Plausible Community Edition.
Sansec reported (2026-10-26) that a Brazilian group injected a skimmer into the analytics script that Convertr's Plausible instance serves to every merchant checkout. Because every Convertr-powered store loads the script automatically, a single server-side modification turned the analytics integration into a supply-chain distribution channel affecting dozens of major Brazilian fashion brands (Convertr handles roughly R$2 billion / US$370M in sales). Affected merchant platforms include Magento, OpenCart and WooCommerce. The script only activated on checkout pages and captured card number, expiry, CVV, cardholder name and CPF, sending them to the exfiltration host 1x0.is.
The campaign began on 2026-10-24. Within about 48 hours (by 2026-10-26) the operators refined the skimmer to match Convertr's exact payment API field names instead of generic payment-field patterns, which Sansec read as evidence of active operator involvement. Sansec attributes the activity to a Brazilian group that has operated since mid-2024, previously compromising individual Magento, OpenCart and WooCommerce stores in Brazil. Its consistent operational patterns include rotating three-letter .is exfiltration domains (changed every few months), pipe-delimited stolen-data format with victim tags, Portuguese-named exfiltration endpoints, and specialisation in Brazilian payment methods.
The suspected entry point is CVE-2026-8467 (GHSA-55hg-8qxv-qj4p): the /storybook component exposed by Plausible Community Edition, which bundles phoenix_storybook, allows unauthenticated command execution. Per the GitHub advisory, an attacker connects to any story's LiveView channel and sends a crafted psb-assign WebSocket event; unsanitized attribute values break out of a HEEx template and are evaluated unsandboxed, giving OS command execution (CWE-94, CVSS v4.0 9.5). The advisory lists phoenix_storybook >= 0.5.0 and < 1.1.0 as affected and 1.1.0 as patched. Sansec states Convertr never upgraded from Plausible 3.0 (installed in 2025) to the patched 3.2.1 released in May 2026. Exploitation of this CVE by the gang is suspected, not confirmed by the sources.
Convertr removed the skimmer, upgraded Plausible to a patched version on 2026-10-27, and notified affected merchants and payment providers. Browser caching meant the malicious script could persist for up to 24 hours after cleanup. Sansec's guidance: shoppers who paid by card on a Brazilian store whose checkout address contained the string 'checkout.convertr' since 2026-10-24 should contact their bank immediately, request card replacement and watch for CPF-based fraud. No malware hashes, IP addresses or full script URLs were published in the cited sources.
MITRE ATT&CK techniques used in TL-2026-4571
Collection
Execution
T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript
Initial Access
T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Impact
Affected products and versions in Convertr Plausible analytics script hijacked for payment
- Plausible Analytics — Plausible Community Edition (self-hosted, bundles phoenix_storybook)
Vulnerable versions: v3.0.0-rc.0 through v3.2.0 (per secondary reporting; Convertr ran 3.0)
Fixed in: 3.2.1 - phenixdigital — phoenix_storybook (Erlang/Elixir package)
Vulnerable versions: >= 0.5.0, < 1.1.0
Fixed in: 1.1.0 - Convertr — Convertr e-commerce platform checkout (Plausible analytics script)
Vulnerable versions: Script served 2026-10-24 to 2026-10-27
Fixed in: Cleaned and Plausible upgraded 2026-10-27
Remediation for Convertr Plausible analytics script hijacked for payment
Patches
- Upgrade Plausible Community Edition to v3.2.1 or later (removes the /storybook endpoint)
- Upgrade phoenix_storybook to 1.1.0 or later
Immediate actions
- Block and monitor outbound requests to 1x0.is from browsers and proxies
- Merchants using Convertr: audit checkout pages for the Convertr Plausible script and verify its integrity against a known-good copy
- Affected cardholders: contact issuing bank, request card replacement, and monitor for CPF-based identity fraud
- Notify payment providers and affected customers of exposure window from 2026-10-24
- Account for browser caching: the malicious script may persist for up to 24 hours after server-side cleanup
Workarounds
- Block or remove external access to the /storybook route and its WebSocket/LiveView channel until patched
Longer-term hardening
- Deploy a Content-Security-Policy restricting script sources and connect-src on checkout pages
- Use Subresource Integrity or self-host third-party scripts on payment pages where feasible
- Deploy client-side script monitoring for checkout pages (Sansec eComscan or equivalent)
- Do not expose developer components such as /storybook on production hosts; maintain patch management for self-hosted analytics
CVEs associated with Convertr Plausible analytics script hijacked for payment
Weaknesses (CWE) in Convertr Plausible analytics script hijacked for payment
Timeline of Convertr Plausible analytics script hijacked for payment
- Brazilian skimming group active since at least July 2024 (month-level date per Sansec/BleepingComputer), compromising individual Magento, OpenCart and WooCommerce stores in Brazil and rotating three-letter .is exfiltration domains.
- GHSA-55hg-8qxv-qj4p / CVE-2026-8467 published: unauthenticated RCE in phoenix_storybook (patched in 1.1.0); Plausible Community Edition 3.2.1 released in May 2026 removing the /storybook endpoint.
- Skimmer injected into Convertr's Plausible analytics script; checkout pages of Convertr merchants begin leaking card data and CPF numbers to 1x0.is.
- Sansec publishes research on the Convertr/Plausible supply-chain skimmer, naming 1x0.is as the exfiltration domain.
- Operators deploy a refined skimmer version tailored to Convertr's exact payment API field names, about 48 hours after the initial injection.
- BleepingComputer reports the campaign and advises shoppers who used checkout.convertr pages since 2026-10-24 to contact their banks.
- Convertr removes the skimmer, upgrades Plausible to a patched version and notifies affected merchants and payment providers; browser caching may keep the script active for up to 24 hours.
Sources cited for Convertr Plausible analytics script hijacked for payment
- Hackers hijack Convertr analytics script to steal payment card data
- Sansec: Brazilian Magecart group skims cards via Convertr Plausible analytics script
- GHSA-55hg-8qxv-qj4p: Unauthenticated RCE via HEEx template injection in phoenix_storybook playground
- NVD: CVE-2026-8467
- phoenix_storybook patch commit 56ab846
Detection coverage for TL-2026-4571
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4571 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.