Attackers compromised a shared analytics script loaded by checkout pages on stores using the Brazilian e-commerce platform Convertr. Malicious code inserted into the legitimate tracker collected payment information as shoppers completed purchases. The suspected initial vulnerability has not been confirmed. Convertr removed the skimmer, updated the analytics software and began notifying affected merchants and payment providers.
Why It Matters
A single shared script can distribute malicious code across many merchant sites. For leaders: third-party and centrally hosted browser scripts can create concentrated payment and trust risk. For defenders: cleanup must include validating the shared component and accounting for cached copies that may persist for up to 24 hours. Shoppers who paid by card on affected checkouts may need to contact their banks. Software supply chains include every script executed in the customer’s browser.
What Defenders Should Do
Merchants should verify the clean script and patched platform, while potentially affected shoppers should clear browser caches and contact their card issuer.