Convertr removes payment skimmer from shared checkout analytics script
Image: Primary Convertr has removed a payment-card skimmer from a shared analytics script and upgraded its Plausible installation to a patched version, security firm Sansec confirmed Tuesday. The compromised script loaded on checkout pages across merchants using the Brazilian e-commerce platform and was configured to steal card details, cardholder names and CPF taxpayer identification numbers.
Sansec says attackers modified a tracker hosted on Convertr's infrastructure. It suspects an unauthenticated command-execution vulnerability provided access, but that route is unconfirmed. Convertr said it was notifying affected merchants and payment providers. Browser caching could keep the malicious script active for up to 24 hours after cleanup, Sansec warned.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
