A shopper returning to a Convertr checkout after its repair could still run the malicious analytics script saved in their browser, according to security firm Sansec. The server-side cleanup has a browser-side remainder. Another payment can still encounter malicious code. [2]

In its October 27 report, BleepingComputer carried Sansec’s confirmation that Convertr had “removed the skimmer and upgraded Plausible to a patched version.” The same report warned that browser caching could keep the malicious script active for up to 24 hours after cleanup. [2]

The script arrived as analytics. Attackers modified a shared Plausible tracker hosted on Convertr’s infrastructure, which loads on checkout pages across merchants using the Brazilian e-commerce platform. That gave the injected code a place beside the shopper’s payment fields. [2]

Sansec identified the campaign on October 24. By October 26, the researchers say, the code specifically targeted Convertr’s payment field names. It was configured to steal card numbers, expiry dates, card security codes, cardholder names and Brazilian taxpayer identifiers. That describes its collection instructions. The report does not establish which fields were actually taken from each shopper. [2]

The suspected entry route also needs its qualifier. Sansec suspects CVE-2026-8467, an unauthenticated command-execution vulnerability in Convertr’s outdated Plausible Community Edition installation. That route remains unconfirmed. [2]

Recovery has separate consequences elsewhere in this week’s reporting. GMO confirmed publication of company and customer data after its Onamae Desktop Cloud intrusion, while BleepingComputer reported that the threatened ransomware activation apparently did not occur. A machine escaping encryption can still leave its owner dealing with stolen information. [1]

For Convertr shoppers, Sansec’s immediate advice is specific: anyone who paid by card since October 24 at a Brazilian store whose checkout address contained “checkout.convertr” should contact their bank immediately and ask to block the card. Clearing a browser cache cannot recover card details already exposed. [2]

Sansec also recommends clearing the cache before another order. Its warning allows up to 24 hours of continued malicious-script activity after cleanup, but the report supplies no precise cleanup time from which a shopper can calculate when that window ends. [2]