Chargebacks & Fraud

Hijacked Shopify App Settings Sent Shoppers to Fake Payment Pages Before Checkout

In mid-October 2026, injected JavaScript in Hulk Product Options, Selleasy and Swym Wishlist Plus cancelled some Checkout clicks, sent shoppers to lookalike card pages, then forwarded them to the real Shopify checkout so the order still completed.

E-commerce 4 Internet Marketers Editorial

In a lamp-lit living room at dusk, a woman in a rust sweater and a young man in plaid lean over a laptop on the coffee table while another man hangs a coat by the door, a pause that fits a household noticing a checkout page that may not belong to the store.

On October 10, 2026, developer Roman Zipp clicked Checkout on mechanicalkeyboards.com and landed on a page that looked like Shopify’s payment form. The address bar told a different story. The site was biliing.top, a lookalike domain, and the form asked for card details. After he submitted test data, the page posted them to the impostor site and then forwarded him to the real Shopify checkout, so the order could still complete.

Zipp traced the redirect to a function named hijack that cancelled the shopper’s Checkout click. It did not come from the store’s theme files. It arrived as a custom JavaScript setting, about 22.7 kilobytes, inside a response from HulkApps’ own product-options API, which the Hulk Product Options theme extension requested on page load. The script stored a session key called __ctf_shim_handoff_done_v1 so it would fire only once per shopper and shop, then let later checkout clicks through. Another session key, __ctf_checkout_txn_v1, also appeared. Shopify’s hosted checkout was not broken. Shoppers who typed a card number on the lookalike page handed that data to whoever ran it.

Three apps, three October dates

HulkApps posted a statement on Zipp’s report on October 15. The company said that on October 10, as part of a wider attack that also hit other Shopify apps, an exploit introduced unauthorized configurations into Hulk Product Options. Those changes affected the app’s theme extension and redirected some checkouts to a fake external page. HulkApps said the redirect did not succeed on every visit and that some browsers blocked it. After a sweep, it said it found no evidence that any of its other apps delivered a checkout redirect. Shopify temporarily disabled the theme extension, then restored it once the unauthorized code was removed and extra safeguards were in place. HulkApps said it had strengthened authentication, added controls against unauthorized configuration changes, and hired an independent firm for incident response and a penetration test.

Logbase, which makes the Selleasy upsell and cross-sell app, published a detailed incident page that it later updated through October 28. It said an attacker used a legacy internal support tool, not merchants’ Shopify accounts, to inject a script that redirected some shoppers to an external site at checkout. The attacker began adding the script at scale at 07:47 UTC on October 13. Logbase said it disabled custom scripts across all Selleasy stores at 12:22 UTC, which stopped the redirects, reported the incident to Shopify at 14:59 UTC, and removed the script from every affected store by 15:58 UTC. It permanently shut down the legacy tool, rotated app secrets, hired Astra Security for an assessment and penetration test between October 16 and 20, and said Shopify re-listed Selleasy on the App Store on October 27. Logbase did not publish a count of affected stores.

Swym Corporation described a separate window for Wishlist Plus. Its October 16 security update and October 20 FAQ say an unauthorized party changed the app’s configuration on October 14 between about 10:06 and 11:56 UTC, which loaded a script on a limited subset of storefronts, mainly collection, product and cart pages where the Wishlist Plus embed rendered. The script did not run passively on every page load. It waited for a checkout click. Swym said mitigation began around 15:02 UTC and that application fixes were fully deployed by 16:32 UTC. It paused Wishlist Plus for every merchant, not only the stores it believed were hit, and revoked Shopify access for Wishlist Plus and its other apps as a precaution. The FAQ later said security remediations and credential rotations were complete and that admin access was being restored in phases.

Swym named checkout-guard.top as the malicious domain it had found, and it listed account-confirm.top, billing-confirm.top and checkout-secure.top as domains seen in similar recent attacks. It told merchants to search theme files for checkout-guard and for unexpected edits attributed to the Swym app. Based on its investigation to date, Swym said it found no evidence that merchant data or customer personal information was compromised inside the Wishlist Plus application, and that the script did not harvest form fields entered on the genuine storefront or on Shopify checkout pages. It also said customer data may have been compromised if shoppers visited the external site and typed their details there by hand. HulkApps separately noted that issuing banks and digital wallets can flag suspicious transactions. That is not the same as a finding that wallet checkouts were untouched, and none of the three vendors published a breakdown of stolen cards by payment method.

What Shopify asked developers to do

On October 20, Shopify published Securing your app, together, asking every app developer to act that week. The list included running Shopify’s new security check, moving to expiring access tokens, treating data rendered from metafields or the developer’s own servers as untrusted, reviewing API logs, and turning on two-step authentication for Partner accounts, hosting, content delivery networks, code repositories and email. Shopify said short-lived tokens would soon be required for public apps, a timeline it later set out in more detail for a January 1, 2027 App Store cutoff. The same day’s merchant changelog added a warning before a storefront sends a shopper to another website. An October 23 update narrowed that prompt so stores block sites Shopify has identified as malicious and ask for confirmation on sites it treats as suspicious.

Third-party trackers later counted hundreds of App Store delistings in the days after these incidents. Shopify has not published an official total that ties those removals to the checkout redirects, and Zipp warned readers that a delisted listing is not proof an app was compromised. The three vendors named above are the ones that have said unauthorized storefront code went out through their own apps.

How store owners can check a live checkout

Owners who used Hulk Product Options, Selleasy or Wishlist Plus in October, or any app that accepts custom JavaScript or HTML, can still test the path a shopper takes. Open a private browser window, add an item, and click Checkout from the cart page and from any cart drawer, on a phone as well as a computer. Until payment, the address bar should stay on the store’s own domain or a myshopify.com checkout, not a third-party site. Because the script Zipp recovered was built to run once per visit, a single clean test does not prove much.

In the browser’s developer tools, session storage keys that start with __ctf_ were left by the script Zipp published. Theme files can be searched for checkout-guard, those same __ctf_ markers, and unexpected .top domains, and Shopify keeps older versions of each theme file if an app edit looks unfamiliar. Custom code boxes inside app settings deserve the same review. If a shopper reports a redirect, Swym asked for the page and the time. Logbase asked affected merchants to reply to its notice. Both pointed owners toward their own duties to notify customers or regulators, including state breach laws, data protection rules such as the General Data Protection Regulation (GDPR), and processor contracts.

That last point matters for stores whose products already draw extra underwriting scrutiny. A CBD, supplement or vape shop on Shopify can see every order finish on the real checkout and still have had shoppers type card numbers on a lookalike page first. A delayed cluster of fraud disputes weeks later can look, to an acquirer, like a sudden quality problem rather than a mid-October redirect. A vape retailer that later sees that pattern may also hear from its processor about the spike, and shops in that spot sometimes look to Tower Payments for vape acquiring options if the current account starts tightening after those disputes land. The app-vetting questions that apply before a high-risk stack goes live, including whether an app can inject custom storefront code, are the same questions worth asking of every app that still sits next to Shopify’s checkout.

The attack did not require a breach of Shopify checkout itself, which is why a store that only watched its own theme files could miss it. The malicious code traveled inside app settings that the store already trusted. HulkApps and Logbase say their apps are safe to use again after the cleanups they described. Swym told merchants the paused app could not use its Shopify access while credentials were revoked, and it asked anyone who saw a redirect on October 14 between 10:06 and 16:32 UTC to write to support. Owners who installed any of the three apps should still run the checkout test, search for the markers above, keep written notes if a shopper was sent off-site, and ask their payment provider to watch cards used in those windows. That work is what turns a vendor’s all-clear into something a store can check for itself.

Sources