Brazilian Skimmers Rode an Analytics Script Into Dozens of Checkouts

A Brazilian card-skimming group slipped its code into an analytics script that every store on the Convertr e-commerce platform loads, putting checkout pages at dozens of Brazilian fashion brands in reach, Sansec reports. The skimmer ran from Oct. 24 until Convertr removed it on Oct. 27. Sansec says it’s the first supply-chain attack by a group that has skimmed Brazilian Magento, OpenCart and WooCommerce stores since 2024.

1×0[.]is
snf[.]is
kk[.]land
nmn[.]is
kof[.]one
anl[.]is
xsox[.]diy
eqp[.]is
shy[.]is
blz[.]is
tray[.]is
miorl[.]net
xwv[.]is
fasthook[.]app
antiddos-protection[.]net

ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7

Source article: Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
Publisher: Sansec (Sansec Forensics Team)
Published: Oct. 26, 2026 (updated Oct. 27, 2026)
URL: https://sansec.io/research/convertr-plausible-supply-chain-attack

Executive Summary

Sansec does not name the group behind this attack; it links it to a Brazilian Magecart crew that has skimmed Magento, OpenCart and WooCommerce stores since 2024, recognizable by its pipe-delimited card records with a per-victim tag, short .is exfiltration domains, Portuguese-named endpoints (cartao.php, pagamento.php), Discord-webhook exfiltration, skimmers for e.Rede, PagSeguro, Pagar.me and Mercado Pago, and a variant that swaps a store’s PIX payment QR code for its own; no other vendor alias is attached. This is the group’s first supply-chain attack. Convertr, a Brazilian e-commerce platform, self-hosts a Plausible Community Edition analytics server whose tracker script, analytics.convertr.app[.]br/js/script.pageview-props.tagged-events.js, loads on every merchant’s pages. Between 05:03 and 23:22 UTC on Oct. 24, 2026 the attacker appended an obfuscated character-code block to that file, decoded and run with eval, that activates only on pages whose URL contains checkout.convertr, collects card number, expiry, CVV, cardholder name and CPF from the payment form and the checkout’s payment API calls, and posts them Base64-encoded to hxxps://1×0[.]is/ws when the order is placed; on Oct. 26 it was updated to match Convertr’s exact payment field names. The suspected way in is CVE-2026-8467, an unauthenticated command-execution flaw reachable through an exposed /storybook path in Plausible CE 3.0.0 through 3.2.0 (fixed in 3.2.1 on May 15, 2026); Convertr ran 3.0, but Sansec had no server logs, so this is unconfirmed. Convertr removed the skimmer and patched on Oct. 27, which Sansec confirmed at 13:08 UTC; browsers may cache the infected script for up to 24 hours. The objective is payment-card and identity theft at scale through one shared file; the impact reaches shoppers at dozens of Brazilian fashion brands. Hunt leads, false-positive expectations, the absence of published rules, and the indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Defense Evasion → Collection → Exfiltration

Hunt Lead Grid

Skimmer Exfiltration Domain and Discord Webhook Sweep

The Convertr skimmer sends each stolen record with a fetch POST (mode no-cors, keepalive true) to hxxps://1×0[.]is/ws, the body being Base64 of a pipe-delimited string of card number, month, year, CVV, two identity fields and the victim tag ctr; Sansec also lists the URL form hxxps://1×0[.]is/ws/<base64>. The same group has used snf[.]is, kk[.]land, nmn[.]is, kof[.]one, anl[.]is, xsox[.]diy, eqp[.]is, shy[.]is, blz[.]is, tray[.]is, miorl[.]net, xwv[.]is, fasthook[.]app and antiddos-protection[.]net, and six Discord webhooks: discord[.]com/api/webhooks/1349318491479605268, …/1349948669419327508, …/1351613753069801583, …/1398562090934993036, …/1414969348262596778 and …/1557650706259902495. The detection logic is a retrospective sweep of DNS, proxy and CSP violation reports for any of the 15 domains, and of proxy logs (where TLS inspection exposes paths) for POSTs to those six webhook IDs, plus a search of every store’s served HTML and JavaScript for the same strings.

Use DNS resolver and web proxy logs from corporate networks (staff who shop at affected stores will generate hits), Content-Security-Policy report-uri or report-to logs from any store that collects them, and a crawl or grep of each storefront’s scripts and database-stored content (CMS blocks, footer scripts, tag-manager containers). Sweep from Oct. 24, 2026 for 1×0[.]is and back to 2024 for the older domains, since the group has been active that long. On a corporate network, a hit identifies a shopper whose card should be replaced; on a store’s own CSP reports or source, a hit means that store is skimming and should be treated as an incident (remove the code, find how it got in, notify the payment provider). Blocking the domains at the corporate proxy is cheap and correct, but stores cannot rely on it: the group rotates short domains, so the string and behavior checks below are the durable control. Blocking discord.com wholesale is the wrong choice where staff use Discord; match the webhook IDs.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Collection → T1056.003 (Input Capture: Web Portal Capture), our mapping for capturing payment-form input on a web page (Sansec lists no ATT&CK IDs); Exfiltration → T1567 (Exfiltration Over Web Service) for the Discord webhook branch

Sources: “Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install”, Sansec, Oct. 26, 2026, https://sansec.io/research/convertr-plausible-supply-chain-attack (source article)

Infected Tracker Hash and Skimmer String Check

The attacker kept the stock Plausible tracker intact and appended an array of character codes that is rebuilt into a string and executed with an indirect eval, which Sansec shows as _s+=String.fromCharCode(_a[_i]);(0,eval)(_s); the decoded code checks indexOf('checkout.convertr') before doing anything, builds the record with a literal |ctr tag, and encodes it with btoa(unescape(encodeURIComponent(raw))). Sansec published the SHA-256 of the infected file as observed on Oct. 26. The detection logic is a content check of every script served on checkout pages (first-party and third-party) for the file hash and for these strings: the indirect-eval decoder pattern, the checkout.convertr test, a pipe-joined record ending in a short victim tag, and the btoa/unescape/encodeURIComponent chain feeding a no-cors keepalive fetch.

Run it as a scheduled fetch of each checkout page’s script URLs (from outside, as a shopper’s browser sees them) with hash comparison against a known-good baseline, plus a grep of web roots and CDN origins for the strings. Sweep current state and any archived copies back to Oct. 24, 2026. The hash will only match this exact build (it already changed once, on Oct. 26), so the string checks are the primary control and the hash a confirmation. Generic String.fromCharCode plus eval also appears in some ad and anti-bot code; anchor on the checkout URL test and the record format before alerting, and treat any match on a payment page as an incident. For third-party scripts you load from another host, Subresource Integrity on the script tag makes a modified file fail to load, which would have stopped this attack for any merchant that pinned the tracker; it does not protect a provider’s own copy, so the provider still needs file-hash monitoring. The check generalizes to Magecart skimmers that append to trusted scripts.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain); Defense Evasion → T1027 (Obfuscated Files or Information) and T1140 (Deobfuscate/Decode Files or Information) (our mapping; the source lists no ATT&CK IDs)

Sources: “Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install”, Sansec, Oct. 26, 2026, https://sansec.io/research/convertr-plausible-supply-chain-attack (source article)

Plausible CE /storybook Requests and Tracker File Changes

Sansec suspects the attacker got onto Convertr’s Plausible server through CVE-2026-8467, which allows unauthenticated command execution through a component library exposed at the /storybook path in Plausible Community Edition 3.0.0 through 3.2.0, then edited the tracker file on disk; Convertr was running 3.0, but its logs were not available, so the route is unconfirmed. Sansec’s own advice for self-hosters is to search access logs for /storybook and compare the files in priv/tracker/js/ with the official release. The detection logic has two parts: a web or reverse-proxy log rule that alerts on any request to a path beginning /storybook on a Plausible host (any response other than 404 raises severity), and file-integrity monitoring on the tracker directory that alerts on any change not matching the hash of the deployed release’s files.

Use reverse proxy, load balancer or WAF access logs in front of Plausible, container or host file-integrity monitoring, and the version reported by the running instance. Sweep access logs as far back as they go, at least to May 2026 when the fix shipped, since exploitation may predate the skimmer. Scope to every self-hosted Plausible CE instance, including ones run by agencies or platforms on behalf of clients. Internet scanners will request /storybook on many hosts, so a request alone on a patched 3.2.1+ server is low priority; on an unpatched one it means rebuild the server, rotate its secrets and diff the tracker files. Upgrading to 3.2.1 or later and blocking /storybook at the proxy are the correct controls; blocking the scanner IPs is not, since any address can send the request. The file-change half generalizes to every self-hosted script that many sites load.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (our mapping of the suspected entry point; the source lists no ATT&CK IDs)

Sources: “Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install”, Sansec, Oct. 26, 2026, https://sansec.io/research/convertr-plausible-supply-chain-attack (source article)

Checkout Page Sending Data to a New Origin

The skimmer runs as JavaScript inside the shopper’s browser on the checkout page and makes one extra request, a POST to a domain the store has never used, at the moment the order is placed; nothing changes on the merchant’s own server, so server logs show nothing. The detection logic is a browser-side correlation per site: Content-Security-Policy reports (report-only mode is enough) or synthetic checkout transactions run by a headless browser that capture every connect, image and script destination contacted from checkout pages, alerting on any destination not on the site’s allowlist, and raising severity when a third-party or shared script loaded on that page changed hash within the previous 72 hours.

Use CSP report-only headers with a report collector, a synthetic monitoring job that walks the checkout with a test card on a schedule, and the script-hash baseline from the previous lead, joined in a SIEM or a dedicated client-side monitoring tool. Run continuously; there is no historical data to sweep unless CSP reporting was already on. Payment, fraud-scoring, analytics and tag-manager vendors all make legitimate calls from checkout, so build the allowlist per site from a clean baseline and review it on every release; alert on new origins rather than on all third-party traffic. A CSP with a strict connect-src would have blocked the request to 1×0[.]is outright, and a script-src without unsafe-eval would have stopped the indirect-eval decoder, so the same data that feeds this detection can harden the page. Any new origin receiving a POST from a payment page is an incident, not a tuning item. The detection generalizes to all client-side skimming, whatever script the attacker compromises.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1059.007 (Command and Scripting Interpreter: JavaScript); Collection → T1056.003 (Input Capture: Web Portal Capture) (our mapping; the source lists no ATT&CK IDs)

Sources: “Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install”, Sansec, Oct. 26, 2026, https://sansec.io/research/convertr-plausible-supply-chain-attack (source article)

Hash Appendix

No published YARA or Sigma rules: Sansec gives strings and indicators but no rule text.

Infected Convertr Plausible tracker

The SHA-256 comes from the source article (file as served on Oct. 26, 2026). The source gives no MD5 or SHA-1; both were sourced via AlienVault OTX’s file analysis record for that SHA-256. The file is the legitimate Plausible tracker with the skimmer appended, so the hash only identifies this infected build.

MD5s

2e8e2677c5eebad051ebc1b8ceae0709  # script.pageview-props.tagged-events.js -> analytics.convertr.app[.]br/js/ (infected tracker, Oct. 26 build; sourced via OTX)

SHA1s

d9652c1b34fdcfa69ca3a69c97edbbe1228d7d2e  # script.pageview-props.tagged-events.js -> analytics.convertr.app[.]br/js/ (infected tracker, Oct. 26 build; sourced via OTX)

SHA256s

ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7  # script.pageview-props.tagged-events.js -> analytics.convertr.app[.]br/js/ (infected tracker, Oct. 26 build)

References Appendix

• “Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install”, Sansec Forensics Team, Oct. 26, 2026 (updated Oct. 27, 2026), https://sansec.io/research/convertr-plausible-supply-chain-attack (source article; injection method, skimmer strings, exfiltration format, IOCs, timeline, CVE-2026-8467 entry point, recommendations)
• AlienVault OTX file analysis for SHA-256 ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7, OTX, checked Oct. 29, 2026, https://otx.alienvault.com/indicator/file/ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 (MD5 and SHA-1)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/