OTX Threat: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics

A Brazilian Magecart group, active since 2024, conducted a supply chain attack by injecting a card skimmer into the Plausible analytics script of Brazilian ecommerce platform Convertr. Starting October 24, 2026, all Convertr checkouts loaded the malicious tracker from analytics.convertr.app.br, stealing card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers. The CVEs: CVE-2026-8467 Sectors: Retail