Personne qui paie en ligne avec une carte de crédit à côté d'un portable, illustrant le vol de cartes sur une page de paiement

Convertr: a hijacked analytics script steals cards on the checkout page

An online store can be hacked without anyone touching the store. That’s what happened this week to Convertr, a Brazilian platform that runs the online store and checkout page for dozens of fashion brands. The malicious code wasn’t in the website: it was in the traffic analytics script, loaded on every checkout page.

According to Sansec, the firm that discovered the attack, this script sent shoppers’ card data to an attacker starting October 24, 2026. Convertr removed it on October 27. The lesson goes beyond Brazil: every script added to your checkout page is one more door.

Checkout page hijacked through an analytics script: what happened

Convertr hosted its own installation of Plausible, an open source analytics tool used as an alternative to Google Analytics. Every store on the platform loaded the same tracking file from that server. The attacker appended an obfuscated block of code to the end of that file, and every shopper who went to pay received it.

According to Sansec, the code only activated on Convertr’s checkout pages. It read the card number, expiry date, CVV, cardholder name and CPF (the Brazilian taxpayer number), then sent them to a domain controlled by the attacker. Two days later, a new version targeted the exact field names of Convertr’s payment interface.

Convertr says its merchants have sold more than 2 billion reais through the platform. The number of cards affected hasn’t been published.

The path, step by step

🛒 Shopper

🏬 Checkout page

📊 Analytics server

🕵️ Attacker

1➜ Gets into Convertr’s Plausible server, never updated since 2025 (suspected entry point, not confirmed).

2✎ Appends an obfuscated block of code to the tracking file, the script every store loads.

3⬇ Every checkout page loads the analytics script as usual. Nothing changes on screen.

4⌨ The shopper types the card number, expiry date, CVV code, name and CPF.

5👁 The added code reads those fields, only on checkout.convertr pages.

6⬅ When the order is placed, everything goes to the 1×0.is domain. The order itself is paid normally.

Sansec has tracked this group since July 2024. Until now, it hacked stores one at a time, mostly on Magento, OpenCart and WooCommerce. Convertr is the first attack Sansec has seen from it against a supplier shared by many stores. We described the classic scenario in our article on the Magento BlockStrap vulnerability.

The suspected way in: a tool that was never updated

Convertr installed Plausible Community Edition 3.0 in 2025 and never updated it. Versions 3.0.0 to 3.2.0 have a critical flaw, CVE-2026-8467, that lets anyone run commands on the server. Plausible fixed it in May 2026, in version 3.2.1. Sansec notes that it hasn’t seen the server logs and so can’t confirm that this is how the attacker got in.

This is the part that matters directly for small businesses: we update WordPress and its plugins, but the analytics tool, form or chat installed “on the side” on another server is often forgotten. We saw it too with the stolen UpdraftCentral keys: the management tool around the site becomes the target.

How long the page was compromised

The exposure window, based on Sansec’s timeline (UTC times)

≈ 18 h

Oct 24, 05:03 ➜ 23:22: between the last clean copy observed and detection

≈ 2.5 days

Oct 24, 23:22 ➜ Oct 27, 12:54: hijacked script served, then removed by Convertr

up to 24 h

After the cleanup: browsers may keep the old script in cache

The exact time of the injection, between 05:03 and 23:22 on October 24, is not known.

Convertr says it removed the code, updated Plausible, changed its credentials and notified merchants, payment providers and the authorities. Sansec confirmed on October 27 that the file was clean.

What your own checkout page loads

Open the source code of your checkout page and you’ll probably find several lines like these. Here’s an annotated fictitious example.

// Checkout page of a fictitious store: the scripts it loads
<script src=”https://stats.fictional-store.ca/js/script.js”></script>  1
<script src=”https://cdn.chat-widget.example/chat.js”></script>  2
<script src=”https://tags.ads.example/pixel.js”></script>  3
<iframe src=”https://pay.processor.example/card-fields”></iframe>  4

What each line means

1Your self-hosted analytics tool. If its server is hacked, this file can change without your site changing. That’s the Convertr scenario.
2A chat widget loaded from another domain. Useful on product pages, rarely needed at the moment of payment.
3An ad pixel. It belongs on the confirmation page, not on the card form.
4Card fields hosted by the payment processor, in a separate frame. Scripts on the page normally can’t read them.

Fictitious example: the domain names are made up. The attacker’s actual code isn’t reproduced here.

And here’s the same fictitious store, page by page. The goal isn’t to strip everything from the site, but to empty the page where the card is entered.

Script (fictitious store)	Home	Product page	Cart	Checkout	Confirmation
Traffic analytics	✔	✔	✔	⚠️	✔
Chat widget	✔	✔	✔	✖
Ad pixel	✔	✔			✔
Customer reviews		✔
Processor card fields				✔

✔ loaded and justified · ⚠️ justify or remove · ✖ remove from the checkout page. The goal: as few scripts as possible where the card is entered.

Eight checks for your checkout page

For your online store (WooCommerce, Shopify or other): 8 checks

☐ List the scripts loaded on the checkout page, with the name of the person responsible for each.
☐ Remove from the checkout page any script that isn’t needed to pay: chat, pixels, heatmaps.
☐ Use card fields hosted by your processor (separate frame or external payment page) rather than a form on your own site.
☐ Update your self-hosted tools (analytics, forms, chat) as seriously as WordPress itself. Convertr hadn’t updated Plausible since 2025.
☐ Add a Content Security Policy (CSP) that limits which domains can receive data from the checkout page.
☐ For external scripts that don’t change, add an integrity check (SRI): the browser refuses a modified file.
☐ Set up an alert when a checkout page script changes, as PCI DSS 4.0 requires for merchants it applies to.
☐ Keep your payment processor’s contact details handy: they’re the first call if a leak is suspected.

A note on integrity checks (SRI): they work well for a fixed file, but a tool that updates its own script breaks them. In that case, the Content Security Policy and the change alert take over.

Did you buy from a Brazilian store whose payment address contained “checkout.convertr” since October 24? Sansec recommends asking your bank to block and replace the card.

These checks require knowing what runs around your website, not just on it. When we build a website, we keep the checkout page as light as possible. Our cybersecurity services include an inventory of third-party scripts and self-hosted tools, and our automated 24/7 monitoring with on-call technician intervention flags unexpected changes on monitored servers and websites.

Book your free cyber check

Do you sell online and don’t know how many third-party scripts load on your checkout page? The free cyber check takes stock of what runs around your store and which updates are overdue.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Photo: Mikhail Nilov, Pexels (Pexels licence).