Analytics scripts are supposed to count your visitors, not count your visitors' credit card numbers. Yet here we are, watching a humble privacy-friendly tracker get drafted into a Brazilian card-skimming operation like an extra who wandered onto the wrong film set.
Plausible Deniability, Implausible Checkout
E-commerce security firm Sansec spotted the campaign on October 24, 2026. Attackers modified a Plausible analytics tracker file on a self-hosted Plausible server run by Convertr, a Brazilian e-commerce platform that powers checkout for dozens of major fashion brands and handles roughly R$2 billion (about $370M) in sales. Because that tracker loaded on the checkout pages of every Convertr merchant, one poisoned file meant a skimmer on all of them.
The skimmer grabbed card numbers, expiration dates, CVV codes, cardholder names, and CPF numbers (Brazil's taxpayer ID). It also got an upgrade mid-heist: early versions used generic payment-field patterns, but by October 26 the attackers had rolled out a refined version targeting Convertr's exact payment API field names. Sansec suspects the way in was CVE-2026-8467, an unauthenticated command-execution flaw in an outdated Plausible Community Edition install — though that hasn't been confirmed. Convertr has since removed the skimmer, upgraded Plausible, and says it's notifying merchants and payment providers.
Your Checkout Is Only as Clean as Its Scripts
This is a textbook supply-chain attack, just wearing a dashboard instead of an npm badge. Sansec ties the group to skimming campaigns against Magento, OpenCart, and WooCommerce stores going back to at least July 2024, so this isn't a one-off — it's a crew that knows exactly where the soft spots are. And the soft spot here wasn't the store code at all. It was a side service nobody thinks of as "production."
The irony is delicious and painful: Plausible is popular precisely because it's the privacy-respecting alternative to big-tech analytics. But self-hosting means self-patching, and an outdated install sitting next to your checkout is a liability no matter how good its intentions. Every third-party or self-hosted script on a payment page deserves the same scrutiny as the payment form itself — subresource integrity, a tight Content Security Policy, and an actual patch schedule.
Sansec also warns that cached copies of the bad script can hang around for up to 24 hours after cleanup, so the hangover outlasts the party. If you shopped on an affected store since October 24, call your bank.
Wondering what else is quietly loading on your checkout pages? Our free developer's security checklist for defending against supply-chain attacks is a solid place to start the inventory.
Source: BleepingComputer