Shopify App Checkout Hijack: What Store Owners Should Check Now

If you run a Shopify store, check your storefront apps today. Since October 10, 2026, attackers have changed the settings or code delivered by several third-party Shopify apps so that shoppers who clicked Checkout were sent to a fake payment page on an outside domain. The developers of Hulk Product Options, Selleasy and Swym Wishlist Plus have each confirmed an incident. On October 20, Shopify told app developers to harden their apps “this week” and added a storefront warning before shoppers leave a store for an outside website.

There is no evidence that Shopify’s own checkout was breached. The risk sits in apps that load code on your storefront. This article covers what is confirmed, what is not, and the checks to run. Facts were checked against Shopify’s changelog and developer forum, the app developers’ own notices and named reporting on October 22, 2026.

What happened to shoppers

According to the developers’ notices and the independent developer who first traced the attack, Roman Zipp, the pattern was the same across apps. Code delivered through an app’s settings or configuration attached itself to the store’s checkout button. A shopper who clicked it landed on a look-alike page on an outside domain that asked for card details. Zipp reports that the details were sent to the attacker and the shopper was then passed to the real checkout, so many orders completed normally. He also reports that the script fired once per browser session, which is why a store owner testing in the same tab could see nothing wrong.

Swym’s notice says shoppers who clicked checkout on affected pages “may have been redirected to an external site that imitated checkout and tried to collect payment card details.” Swym says it does not collect, process or store card data itself.

Which apps are confirmed

The table below separates what each developer has confirmed from what has only been reported. Durations are our own arithmetic from the published times.

App (developer) Date and window (UTC) Confirmed by Status at check time

Hulk Product Options (HulkApps) Found October 10; no window published HulkApps statement, as quoted by Roman Zipp: “an exploit” introduced unauthorized configurations Code removed; Shopify temporarily disabled the theme extension, then restored it

Selleasy (Logbase) October 13, 07:47 to 15:00 (7 h 13 min, per iTnews) Logbase incident page: an unauthorized script was injected into some stores Logbase says the root cause was fixed and it found no evidence of a backend or database breach; independent audit under way

Swym Wishlist Plus (Swym) October 14, 10:06 to 11:56 (1 h 50 min); fixes fully deployed 16:32 Swym security response page (updated October 16) Swym’s October 20 FAQ says further activity used the app’s access; app paused for all merchants and its Shopify access revoked, with no restore date

Other apps named by merchants or delisted October 17 to 22 Not confirmed by their developers as part of this attack Treat as unverified; delisting alone does not prove compromise

Built by E-commerce Partners from the HulkApps statement quoted by Roman Zipp, the Logbase Selleasy incident page (updated October 16, 2026), Swym’s security response page and incident FAQ, and iTnews. Checked October 22, 2026.

Shopify has not published a list of affected apps, domains or store counts. Logbase says Selleasy is used by more than 49,000 active stores, according to iTnews, but has not said how many were hit. Several other apps were named by merchants or removed from the App Store in the same week, but their developers have not linked them to this campaign, so we do not name them here.

What Shopify has done

October 20, storefront change. Shopify’s changelog entry “New protection against unexpected redirects” says your storefront now shows customers a confirmation, with the destination address, before sending them to a website outside your store. Domains connected to your store and supported Shopify and social sites do not trigger it. Sites you own but have not connected to the store may. The entry does not describe a setting to turn it off.

What this means for you: if you send shoppers to your own separate domain (a booking site, a wholesale portal, a help desk), connect it to the store or expect customers to see the prompt. Test those links today.

October 20, developer post. In “Securing your app, together” on its developer forum, Shopify asked app partners to act “this week”: scan apps with its AI Toolkit security check, move to expiring access tokens (“This will soon be required for all public apps”), treat rendered data as untrusted, review API request logs and turn on two-step authentication. It also says partners are “accountable to fix the problem and notify affected merchants.” Shopify lists three planned changes: tighter limits on storefront app code, IP restrictions so app keys only work from the developer’s servers, and higher App Store security requirements. It gives no dates and says it will share details first.

October 17, statement. A Shopify spokesperson told iTnews: “When an app falls short, we act,” adding that this can include delisting an app.

What to check on your store today

This checklist is read-only. It does not ask you to run code or change app settings. It is assembled from Swym’s FAQ, Roman Zipp’s guidance and the app embed settings in Shopify Help.

List your storefront apps. In Shopify admin, go to Settings > Apps. Note any of the three confirmed apps and any app with a “custom JavaScript”, “custom code” or HTML field in its settings.
Review app embeds. Go to Online Store, click Edit theme on your live theme, then click the App embeds icon in the sidebar (Shopify Help, checked October 22, 2026). Confirm you recognize every enabled embed. Turn off embeds for apps you no longer use.
Test checkout in a fresh private window. Add a product, open the cart and click Checkout. The address bar should show your store domain or Shopify checkout. Close the window and repeat in a new one, because the script reportedly fired once per session.
If you use Swym Wishlist Plus, follow Swym’s FAQ: look in your live theme for file edits made by the Swym app and search the theme files for “checkout-guard”. Swym asks you to check with your developer and test before removing code, and to report shopper complaints to [email protected] with the page and time.
Watch your inbox. Signs include customers reporting an extra payment page, a payment error before the real checkout, a double card entry, or card fraud soon after buying from you.
Tighten access. Change your Shopify password, turn on two-step authentication for staff, and remove apps and collaborator accounts you do not need.
If you find something, take a screenshot with the address bar visible, save the URL and contact Shopify Support and the app developer. Do not keep testing with real card details.

Customers, chargebacks and notification

Customers whose cards were captured on a fake page may see fraud later and dispute charges. Keep order records and customer reports from October 10 onward. Our guide on what happens when a customer files a Shopify chargeback covers the process, and our piece on chargeback ratio limits explains why a spike matters.

Swym’s notice tells merchants to check their own obligations to notify shoppers or regulators and to consult their advisors. Whether you must notify anyone depends on where you and your customers are, and we do not interpret those rules here. If you think your store was affected, ask a qualified advisor.

Why this matters beyond these apps

Every storefront app that loads code on your pages can change what shoppers see at checkout. The same risk applies to any platform: a fake Stripe form skimming WooCommerce carts earlier this year used the same idea, and this week’s UpdraftPlus and Rank Math PRO breaches came through trusted plugins too. Fewer storefront apps means fewer ways in. Our e-commerce security checklist for small stores covers the wider routine.

What is still unknown

How the attackers got into each developer’s systems. HulkApps has called it “an exploit” without publishing the entry point; Logbase says an internal tool was accessed; Swym says an access channel was used.
How many stores and shoppers were affected. No developer or Shopify has published a count.
Whether more apps were involved. Several other apps were delisted or named by merchants without confirmation from their developers.
When Swym Wishlist Plus returns, and when Shopify’s planned platform changes take effect.

We will update this article as Shopify and the developers publish more.

Sources

Shopify Changelog, “New protection against unexpected redirects” (October 20, 2026). changelog.shopify.com
Shopify Developer Community, “Securing your app, together” (October 20, 2026). community.shopify.dev
Logbase, Selleasy incident update (October 13, updated October 16, 2026). logbase.io
Swym, “Swym Wishlist Plus Security Incident” (updated October 16, 2026). getswym.com
Swym, Wishlist Plus incident FAQ (October 20, 2026). getswym.com
Roman Zipp, “Shopify shops hit with ongoing Checkout Hijack attack” and “Statements from companies involved” (from October 10, 2026; independent researcher). romanzipp.com
Shopify Help, “App embeds” in the theme editor (checked October 22, 2026). help.shopify.com
iTnews, “Shopify tells Australian store to stay shut after hijacked extensions divert shoppers” (October 16, updated October 17 and 19, 2026; reported). itnews.com.au

Last reviewed: October 22, 2026. App status, windows and Shopify actions match the sources above as checked on that date. This is a developing story.

How this article was made: researched and drafted with AI assistance, with every factual claim checked against the sources above. The confirmation table and checklist are our own summaries of the developers’ notices and named reporting; window durations are our arithmetic. No store was tested.

Related guides

Your Checkout Page May Be Breaking PCI Rules Right Now
Card Testing Bots Skip Your Checkout Form. Stop Them
What Happens If a Customer Says Their Package Never Arrived?

Marketing & Advertising Magazine