A group of hackers, probably not on Santa's nice list, decided it was a good idea to hijack an analytics script from Brazilian e-commerce platform Convertr. This little escapade let them steal payment details like credit card numbers from unsuspecting shoppers—because nothing screams holiday spirit like a little identity theft.
The Lowdown
On October 24, security experts identified the hackers, who have been busy as bees since at least July 2024, targeting online shops running Magento, OpenCart, and WooCommerce platforms. Their weapon of choice? A shared analytics script that Convertr used to help major fashion brands sell nearly R$2 billion (that’s about $370 million for those of us not fluent in Brazilian reais).
Convertr, in its infinite wisdom, had hosted an outdated version of an open-source analytics tool called Plausible. This seems to have made it easy-peasy for hackers to slip through the cyber defenses. It’s almost as if they just left the door wide open with a neon sign saying "Come In!"
How They Did It
According to the cybersecurity firm Sansec, which sounds like a place where you'd go to buy an overpriced coffee, the attackers modified the Plausible tracker file on Convertr’s server. They probably found it as easy as finding a Wi-Fi network named "HackerTown."
They supposedly took advantage of a vulnerability (CVE-2026-8467, if you’re into that kind of detail), though we’re still waiting for those details to be confirmed. Once in, the villains injected malicious code into the legitimate analytics tracker that all the merchants using Convertr had loaded on their checkout pages. So, while people thought they were just buying shoes, the hackers were busy collecting their card numbers, CVVs, and other juicy details.
What Was Stolen?
By October 26, the hackers upgraded their tactics—no more generic patterns, thank you very much. They crafted a skimmer that specifically targeted Convertr’s payment API, giving them the following info:
- Payment card number
- Expiry date
- CVV code
- Cardholder name
- CPF taxpayer ID number
Ah yes, nothing says "shopping adventure" quite like a side of price gouging for stolen personal information.
What Happens Now?
If you’ve made a purchase on a site using Convertr since October 24, and you saw ‘checkout.convertr’ in the URL, it might be time to call your bank. They might not be thrilled to hear your card info was just hanging out in a hacker's pocket.
Sansec has confirmed that Convertr acted quickly—removing the skimmer and updating to a patched version of Plausible. Kudos for that, but let’s hope they didn't wait for a second incident.
To add to the fun, researchers have warned that even after the threat has been eliminated, the malicious script might linger in browser caches for up to 24 hours. So, if you’ve been shopping, be sure to clear your cache before continuing your spree. Or better yet, consider using disposable virtual cards—because who doesn’t want to make life even more complicated?
So there you have it, a perfect blend of convenience and caution gone awry. Happy shopping this holiday season—just don’t forget your virtual armor!
