# Convertr checkouts still serving card skimmer, Sansec finds

_Published Monday, October 26, 2026 at 3:13 PM EDT · Security · Latest · Tier 2 — Notable_

![Convertr checkouts still serving card skimmer, Sansec finds — Primary](https://sansec.io/assets/og/convertr-plausible-supply-chain-attack.jpg)

Convertr was still serving malicious code that steals shoppers' payment details on 26 October, security firm Sansec reported. The code began sending card details and Brazilian taxpayer numbers, known as CPFs, to an attacker's server on 24 October.

Convertr operates stores and checkouts for dozens of Brazilian fashion brands. Attackers modified a shared analytics script loaded by every Convertr checkout, allowing the code to collect payment form data and read requests to the payment API.

Sansec suspects a previously patched flaw in Convertr's outdated Plausible analytics software enabled the intrusion, but has not examined server logs to confirm the entry point. Browser caching can preserve the infected script for up to 24 hours after cleanup.

## Sources

- [Sansec - experts in eCommerce security](https://sansec.io/research/convertr-plausible-supply-chain-attack)

---
Canonical: https://techandbusiness.org/newswire/6E-vPeRngpwBpehMHmc62x
Published: 2026-10-26T19:13:40.653Z
Story chronology: 2026-10-26T00:00:00.000Z
Retrieved: 2026-10-26T21:29:19.397Z
Publisher: Tech & Business (techandbusiness.org)