A credit card skimming campaign recently compromised a shared analytics script used by the Brazilian e-commerce platform Convertr to harvest sensitive payment data from online shoppers, according to a recent report by Bleeping Computer.
The breach, identified on Oct. 24, involved the injection of malicious code into a Plausible analytics tracker hosted on Convertr’s infrastructure. Security firm Sansec suggests the attackers likely exploited an unauthenticated command-execution vulnerability in an outdated version of the Plausible Community Edition to gain initial access. By Oct. 26, the attackers refined the skimmer to specifically target Convertr’s payment API, allowing them to capture cardholder names, payment card numbers, expiration dates, CVV codes and CPF taxpayer identification numbers. Convertr, which supports dozens of major fashion brands, has since removed the malicious script and upgraded its software. However, researchers warn that browser caching may keep the skimmer active for up to 24 hours following the cleanup. Customers who utilized affected checkout pages are advised to contact their banks to block compromised cards and clear their browser cache before making future purchases. While Convertr is currently notifying impacted merchants and payment providers, the incident highlights the significant risks posed by supply chain vulnerabilities in third-party analytics tools used across the e-commerce industry.
Source: Bleeping Computer
