Actor Profile

A Brazilian credit card skimming group active since at least July 2024, specializing in supply chain attacks against e-commerce platforms. The group focuses on compromising online stores running Magento, OpenCart, and WooCommerce platforms. In this campaign, the actors pivoted to a higher-impact supply chain vector by compromising Convertr, a Brazilian e-commerce platform handling R$2 billion ($370M) in sales for dozens of major fashion brands. The group's motivation is financial gain through theft of payment card data and personally identifiable information (PII) from online shoppers during checkout transactions.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Suspected exploitation of CVE-2026-8467, an unauthenticated command-execution vulnerability in Convertr's outdated Plausible Community Edition analytics installation (T1190 - Exploit Public-Facing Application). Execution: Injection of malicious JavaScript code into legitimate Plausible analytics tracker file hosted on Convertr's self-managed server (T1059.007 - Command and Scripting Interpreter: JavaScript). Collection: Credit card skimming via modified payment form fields targeting card numbers, expiration dates, CVV codes, cardholder names, and CPF taxpayer identification numbers (T1056.003 - Input Capture: Web Portal Capture). The skimmer evolved from generic payment-field patterns to specifically target Convertr's exact payment API field names by October 26. Persistence: Malicious script persisted through browser caching for up to 24 hours post-remediation. Impact: Supply chain compromise affecting multiple downstream merchants using the Convertr platform (T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain).

Targets & Patterns

The group targets e-commerce and retail sectors, with specific focus on Brazilian online merchants. In this campaign, they compromised Convertr, a Brazilian e-commerce platform serving dozens of major fashion brands. The targeting pattern demonstrates strategic selection of supply chain chokepoints to maximize victim reach—by compromising a single shared analytics script, the attackers gained access to payment data across all merchants using Convertr's checkout system. Previous activity shows the group targets stores running popular e-commerce platforms (Magento, OpenCart, WooCommerce), indicating opportunistic targeting based on platform vulnerabilities and widespread adoption. The theft of CPF taxpayer identification numbers alongside payment card data suggests targeting is specifically tailored to Brazilian e-commerce infrastructure and regulatory requirements.

Historical Context

The group has been active since at least July 2024, conducting Magecart-style attacks against e-commerce platforms. The October 24, 2026 Convertr compromise represents an evolution in their tactics, moving from direct compromise of individual merchant sites to higher-impact supply chain attacks targeting shared infrastructure. The refinement of their skimmer code between October 24 and October 26—transitioning from generic payment-field patterns to Convertr-specific API field names—demonstrates active development and adaptation during ongoing operations. This supply chain approach aligns with broader Magecart ecosystem trends of targeting third-party scripts and analytics platforms to achieve scale. Convertr removed the skimmer and upgraded Plausible to a patched version following disclosure, and began notifying affected merchants and payment providers.

Defensive Recommendations

  • Monitor for unauthorized modifications to third-party analytics scripts and implement file integrity monitoring (FIM) on web assets, particularly JavaScript files loaded on checkout pages
  • Detect T1190 exploitation attempts by monitoring for unusual command execution on public-facing web applications, especially analytics platforms; apply CVE-2026-8467 patches to Plausible Community Edition installations immediately
  • Implement Content Security Policy (CSP) headers with strict script-src directives to prevent execution of unauthorized JavaScript and detect T1059.007 malicious script injection attempts
  • Deploy client-side security solutions that monitor for T1056.003 payment form data exfiltration by detecting unauthorized POST requests from checkout pages to external domains
  • Conduct supply chain risk assessments of third-party scripts loaded on payment pages; use Subresource Integrity (SRI) hashes to verify script authenticity and prevent T1195.002 supply chain compromises