Plan
active
Hackers hijack Convertr analytics script for payment card skimming
- Engineer — Plan: If you load third-party analytics scripts at checkout, audit your CSP and subresource integrity (SRI) settings; inventory any Convertr script dependencies and verify their current integrity hashes.
- SOC/IR — Plan: Build or tune a detection for unexpected script mutations or new external script loads on checkout pages; hunt for anomalous POST requests to unfamiliar domains from e-commerce endpoints.
- Leader — Learn: Third-party script supply-chain skimming is a recurring risk vector for e-commerce; useful framing for vendor risk discussions, but no immediate leadership action is indicated without confirmation of organizational exposure.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.