# Convertr Plausible analytics script hijacked for payment card skimming (CVE-2026-8467)

> A Brazilian Magecart-style gang, active since at least July 2024, planted a card skimmer in the Plausible analytics script served by Brazilian e-commerce platform Convertr, harvesting card numbers, expiry dates, CVVs, cardholder names and CPF taxpayer IDs from dozens of merchants' checkouts from 2026-10-24. Initial access is suspected (unconfirmed) via CVE-2026-8467, an unauthenticated remote code execution flaw in Convertr's never-updated Plausible Community Edition.

- **Published:** 2026-10-27T21:43:25Z
- **Last reviewed:** 2026-10-27T21:43:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4571
- **ID:** TL-2026-4571
- **Severity:** HIGH (CVSS 9.5)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8467

## Description

Sansec reported (2026-10-26) that a Brazilian group injected a skimmer into the analytics script that Convertr's Plausible instance serves to every merchant checkout. Because every Convertr-powered store loads the script automatically, a single server-side modification turned the analytics integration into a supply-chain distribution channel affecting dozens of major Brazilian fashion brands (Convertr handles roughly R$2 billion / US$370M in sales). Affected merchant platforms include Magento, OpenCart and WooCommerce. The script only activated on checkout pages and captured card number, expiry, CVV, cardholder name and CPF, sending them to the exfiltration host 1x0.is.

The campaign began on 2026-10-24. Within about 48 hours (by 2026-10-26) the operators refined the skimmer to match Convertr's exact payment API field names instead of generic payment-field patterns, which Sansec read as evidence of active operator involvement. Sansec attributes the activity to a Brazilian group that has operated since mid-2024, previously compromising individual Magento, OpenCart and WooCommerce stores in Brazil. Its consistent operational patterns include rotating three-letter .is exfiltration domains (changed every few months), pipe-delimited stolen-data format with victim tags, Portuguese-named exfiltration endpoints, and specialisation in Brazilian payment methods.

The suspected entry point is CVE-2026-8467 (GHSA-55hg-8qxv-qj4p): the /storybook component exposed by Plausible Community Edition, which bundles phoenix_storybook, allows unauthenticated command execution. Per the GitHub advisory, an attacker connects to any story's LiveView channel and sends a crafted psb-assign WebSocket event; unsanitized attribute values break out of a HEEx template and are evaluated unsandboxed, giving OS command execution (CWE-94, CVSS v4.0 9.5). The advisory lists phoenix_storybook >= 0.5.0 and < 1.1.0 as affected and 1.1.0 as patched. Sansec states Convertr never upgraded from Plausible 3.0 (installed in 2025) to the patched 3.2.1 released in May 2026. Exploitation of this CVE by the gang is suspected, not confirmed by the sources.

Convertr removed the skimmer, upgraded Plausible to a patched version on 2026-10-27, and notified affected merchants and payment providers. Browser caching meant the malicious script could persist for up to 24 hours after cleanup. Sansec's guidance: shoppers who paid by card on a Brazilian store whose checkout address contained the string 'checkout.convertr' since 2026-10-24 should contact their bank immediately, request card replacement and watch for CPF-based fraud. No malware hashes, IP addresses or full script URLs were published in the cited sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1056 Input Capture
- T1657 Financial Theft

## Sources

- [Hackers hijack Convertr analytics script to steal payment card data](https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/)
- [Sansec: Brazilian Magecart group skims cards via Convertr Plausible analytics script](https://sansec.io/research/convertr-plausible-supply-chain-attack)
- [GHSA-55hg-8qxv-qj4p: Unauthenticated RCE via HEEx template injection in phoenix_storybook playground](https://github.com/advisories/GHSA-55hg-8qxv-qj4p)
- [NVD: CVE-2026-8467](https://nvd.nist.gov/vuln/detail/CVE-2026-8467)
- [phoenix_storybook patch commit 56ab846](https://github.com/phenixdigital/phoenix_storybook/commit/56ab846)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4571