Skimmer Hits Convertr Checkout Script, Draining Card Data From Brazilian Fashion Sites
Researchers suspect a critical Phoenix Storybook flaw gave attackers the foothold to tamper with an analytics file loaded on every merchant's checkout page.
Key points
- Attackers likely exploited CVE-2026-8467, a critical unauthenticated code execution flaw in Phoenix Storybook, to break into Convertr and plant a card skimmer, according to Sansec.
- The campaign was spotted on 24 October 2026 and tampered with a Plausible analytics file hosted on Convertr's own servers, which loads on checkout pages across dozens of Brazilian fashion brands.
- Convertr handles R$2 billion (about $370 million) in annual sales for its merchants.
- Stolen fields included card number, expiry, CVV and cardholder name, plus the CPF Brazilian taxpayer ID.
- Convertr has since removed the skimmer and upgraded Plausible, but cached copies of the malicious script can linger in browsers for up to 24 hours.
A credit card skimming crew quietly rewrote an analytics file used by Convertr, a Brazilian e-commerce platform that powers checkout for dozens of fashion retailers, and used it to siphon shoppers' card details straight out of the payment form.
The tampering was spotted on 24 October 2026 by Sansec, an e-commerce security firm that monitors online stores for skimmer code. Convertr processes around R$2 billion (roughly $370 million) in sales a year on behalf of its merchants, so a single modified file reached a lot of checkouts at once.
They didn't need to break into every shop. One file was enough.
How did the attackers get in?
Sansec believes the entry point was an outdated install of Plausible Community Edition, an open source alternative to Google Analytics that Convertr ran on its own server. The specific flaw suspected is CVE-2026-8467, a critical unauthenticated code execution bug in Phoenix Storybook, a developer tool bundled into some Elixir web applications.
In plain terms: a feature meant to preview user interface components accepted attribute values from anyone on the internet and dropped them straight into a template the server then ran as code. No login required. Sansec hasn't confirmed exploitation of that specific bug, only that it fits the profile of Convertr's exposed install.
What did the skimmer steal?
Once inside, the attackers edited the Plausible tracker file hosted on Convertr's infrastructure. That file loads on the checkout page of every merchant using the platform, meaning the malicious script ran in shoppers' browsers across the whole customer base.
An early version of the skimmer used generic patterns to find payment fields. By 26 October 2026 the crew pushed a tidier version matched to Convertr's actual API field names, which Sansec reads as a sign the attackers had studied the platform closely.
| Data stolen | Notes |
|---|---|
| Card number | Captured at checkout |
| Expiry date | Captured at checkout |
| CVV | Captured at checkout |
| Cardholder name | Captured at checkout |
| CPF taxpayer ID | Brazilian national tax number |
Sansec attributes the campaign to a Brazilian group active since at least July 2024, which has focused on stores running Magento and WooCommerce, among others. The group has now shown it's comfortable going one layer up the supply chain and poisoning a shared script instead of individual shops. We covered a related escalation just two days before this incident in our report on nearly 1,000 stores hijacked through a Magento banner feature.
What should shoppers do?
If you paid by card on a Brazilian online store between 24 October 2026 and the cleanup, and the checkout URL contained "checkout.convertr", call your bank and ask to block the card. Watch statements for small test charges, which skimming crews often run before larger purchases.
Clear your browser cache before shopping on any affected store again. Sansec warned that cached copies of the malicious script can keep running in browsers for up to 24 hours after the server-side cleanup. Convertr has told Sansec it's notifying merchants and payment providers, and has upgraded Plausible to a patched release.
The Phoenix Storybook flaw is the story under the story. It's a developer convenience tool that should never have been reachable from the public internet, and it's almost certainly sitting exposed on other production servers right now. Watch for copycat probes.
