Card skimmers found on 953 online stores and Brazilian Convertr checkouts

You can do everything right and still have your card stolen at an online checkout. This week, researchers at e-commerce security firm Sansec reported two campaigns that hide card-stealing code inside real shops: a loader found on 953 online stores, most running the Magento shop software, and a skimmer planted in a script shared by the checkouts of dozens of Brazilian fashion brands.^{1, 2}

Reporting checked October 28, 2026.

Too long; didn’t read?

• If you paid by card since October 24 on a Brazilian store whose checkout address contained “checkout.convertr”, Sansec advises contacting your bank to block the card.³
• Convertr has since removed the skimmer, according to Sansec.²
• The US agency CISA says the Magento flaw used in part of the 953-store campaign is being exploited in real attacks.⁴
• Paying with a digital wallet or a virtual card, and turning on card alerts, limits the damage skimmers can do.

How web skimming works

A web skimmer is a small piece of hidden code on a real shop’s payment page. You type in your card number, expiry date and security code as usual, the order goes through, and at the same moment the skimmer quietly sends a copy of everything to the criminals. The shop looks and works normally, which is why shoppers rarely notice. Attackers usually get in through an unpatched flaw in the shop software or one of the outside services the page loads.

Convertr: one file, many shops

Convertr is a Brazilian platform that runs online stores and checkouts for dozens of fashion brands. Sansec says a Brazilian card-skimming group, active since 2024, added a skimmer to the website analytics script that every Convertr checkout loads. From October 24, the code captured the card number, expiry date, security code, cardholder name and CPF (the Brazilian taxpayer number) entered on checkout pages.^{2, 3}

Sansec suspects the attackers got in through a known flaw in an outdated version of the analytics software Convertr ran on its own server, but BleepingComputer notes this hasn’t been confirmed.³ In an update on October 27, Sansec said Convertr had removed the skimmer, updated the software and was notifying affected merchants, payment providers and authorities. Sansec confirmed the script was clean again.²

The 953-store campaign

Separately, Sansec found a small “loader” (code that fetches further instructions from an attacker’s server) on 953 online stores, mostly running Magento, in a campaign that has been going since July 2025. The loader checks each visitor and only delivers its payload to what look like real shoppers, which helps it avoid detection. In March, 471 Magento stores were infected through a flaw nicknamed PolyShell (CVE-2026-48356), and Sansec says even fully patched stores have been reinfected, including one on October 23.¹

On October 27, CISA added that Adobe Commerce and Magento flaw to its catalog of vulnerabilities known to be exploited in real attacks.⁴ Sansec has not said how many shoppers had their cards stolen in this campaign.¹

What you can do

• Use a digital wallet when the shop offers one. Apple says that when you pay with Apple Pay in apps and on the web, your actual card number isn’t shared with the merchant.⁵ A skimmer on the shop’s card form has nothing to copy if you never type your card number into it.
• Ask your bank about virtual cards. Many banks and card apps can create a separate card number for online shopping, sometimes limited to a single shop or a single purchase, which you can cancel without replacing your real card.
• Turn on instant transaction alerts in your banking app, and check your statements for small charges you don’t recognise. Criminals sometimes test a stolen card with a small payment first.⁶
• If you think your card was exposed, call the number on the back of the card or in your banking app and ask to block or replace it.⁶
• Dispute any charge you didn’t make as soon as you see it. For US credit cards, you must also send a written notice within 60 days after the charge appeared on your statement; other countries have their own deadlines, so ask your bank.⁷

Sources

1. SecurityWeek, October 26, 2026: 953 online stores infected in long-lasting malware campaign
2. Sansec, October 26, 2026 (updated October 27): Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
3. BleepingComputer, October 27, 2026: Hackers hijack Convertr analytics script to steal payment card data
4. CISA, October 27, 2026: CISA adds two known exploited vulnerabilities to catalog
5. Apple: Apple Pay & Privacy
6. Office of the Comptroller of the Currency: Credit card and debit card fraud
7. Consumer Financial Protection Bureau: How do I dispute a charge on my credit card bill?