Kredit karta skimming guruhi e-tijorat platformasi Convertr tomonidan ishlatiladigan umumiy tahlil skriptini buzib, xaridorlarning to'lov ma'lumotlarini o'g'irlash uchun foydalanilgani xabar qilinmoqda.
Kampaniya 24-oktabrda aniqlangan va kamida 2024-yil iyulidan beri faol bo'lgan, Magento, OpenCart va WooCommerce platformalarida ishlaydigan onlayn do'konlarni yuqtirishga ixtisoslashgan braziliyalik guruhga tegishli deb hisoblanmoqda.
Convertr — Braziliya e-tijorat platformasi bo'lib, mamlakatdagi o'nlab yirik moda brendlarining onlayn do'konlari va to'lov tizimlarini quvvatlaydi va R$2 milliard ($370 million) savdoni boshqaradi.
E-tijorat xavfsizlik firmasi Sansec ma'lumotiga ko'ra, hujumchi Convertr tomonidan boshqariladigan o'z-o'zini boshqaradigan serverda joylashgan Plausible kuzatuvchi faylini o'zgartirgan.
Sansec shuningdek, hujumchi Google Analytics'ga ochiq manba muqobil bo'lgan Plausible'ning o'z-o'zini boshqaradigan serveridagi kuzatuvchi faylini o'zgartirganini aytadi.
Sansec hujumchilarning dastlabki kirish uchun Convertr'ning eskirgan Plausible Community Edition o'rnatilishiga ta'sir qiluvchi CVE-2026-8467, autentifikatsiyasiz buyruq bajarish zaifligidan foydalangan deb gumon qiladi. Biroq bu tasdiqlanmagan.
Kirishni qo'lga kiritgandan so'ng, hujumchilar Convertr infratuzilmasida joylashgan qonuniy Plausible tahlil kuzatuvchisiga zararli kodni kiritgan, bu esa platformadan foydalanadigan barcha savdogarlarning to'lov sahifalarida yuklanadi.
.jpg)
Magecart hujum zanjiri Manba: Sansec
Sansec ma'lumotiga ko'ra, skimmerning avvalgi versiyalari umumiy to'lov maydoni naqshlaridan foydalangan, ammo 26-oktabrga kelib hujumchilar aniq Convertr to'lov API maydon nomlarini maqsad qilgan yanada takomillashgan versiyani joriy etgan.
Kiritilgan skimmer to'lov sahifalaridan quyidagi ma'lumot turlarini o'g'irlash uchun sozlangan:
- To'lov kartasi raqami
- Amal qilish muddati
- CVV kodi
- Karta egasining ismi
- CPF soliq to'lovchi identifikatsiya raqami
Tadqiqotchilar 24-oktabrdan beri to'lov sahifasi manzilida 'checkout.convertr' qatorini o'z ichiga olgan Braziliya do'konida karta bilan to'lov qilganlar darhol banklari bilan bog'lanib, kartani bloklashni so'rashlari kerakligini taklif qilmoqda.
Bugungi yangilanishda Sansec Convertr "skimmerni olib tashlagan va Plausible'ni tuzatilgan versiyaga yangilagan" deb tasdiqladi va kompaniya ta'sirlangan savdogarlar va to'lov provayderlarini xabardor qilishini e'lon qilganini qayd etdi.
BleepingComputer Convertr'dan hodisa bo'yicha izoh so'ragan, ammo hali javob olmagan.
Sansec tadqiqotchilari brauzer keshlashi tozalashdan keyin ham ta'sirlangan saytlarda zararli skriptni 24 soatgacha faol saqlashi mumkinligi haqida ogohlantirdi, shuning uchun mijozlar tahdid bartaraf etilgandan keyin ham yangi buyurtma berishdan oldin keshni tozalashlari kerak.
Onlayn xarid qilishda to'lov kartasi ma'lumotlarini himoya qilishning bir usuli — tranzaksiyadan so'ng darhol muddati tugaydigan bir martalik virtual kartalardan foydalanish.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi.
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikaga qarab mudofaa choralarini o'lchaydi.
Hisobotni oling
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.
The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.
Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.
E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.
Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible,an open source alternative to Google Analytics, managed by Convertr.
Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.
After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform.
.jpg)
The Magecart attack chain Source: Sansec
Sansec says that earlier versions of the skimmer used generic payment-field patterns, but by October 26, the attackers pushed a more refined version that specifically targeted Convertr’s exact payment API field names.
The injected skimmer was configured to steal the following data types from checkout pages:
- Payment card number
- Expiration date
- CVVs code
- Cardholder name
- CPF taxpayer identification number
The researchers suggest that those who paid by card on a Brazilian store that contained the ‘checkout.convertr’ string in the checkout address page since October 24 should contact their bank immediately and ask to block their card.
In an update today, Sansec confirmedthat Convertr "removed the skimmer and upgraded Plausible to a patched version," noting that the company announced it was notifying affected merchants and payment providers.
BleepingComputer has contacted Convertr for a statement on the incident, but we have not received a response yet.
Sansec researchers warned that browser caching could keep the malicious script active on impacted sites for up to 24 hours after cleanup, so customers should clear their cache before placing new orders, even after the threat has been eliminated.
One way to protect payment card details when shopping online is to use disposable virtual cards that expire immediately after a transaction.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report