Shopify Apps Hijacked: What Happened in the October 2026 Fake Checkout Attacks

In October 2026, attackers used several third-party Shopify apps to send some shoppers to fake checkout pages. The apps confirmed by their own developers are Hulk Product Options (HulkApps), Selleasy (Logbase) and Swym Wishlist Plus. Shopify itself was not breached. The attackers changed the apps’ settings or used the apps’ own access to stores, so a shopper who clicked Checkout was sent to a lookalike page built to collect their details, then passed on to the real checkout. How the attackers got in has not been made public.

This article sets out what is confirmed, as of 22 October 2026, from the developers’ own statements, Shopify and the people who first found it. We’ll update it as new facts come out.

If you run a Shopify store, start here: how to check if your store was affected.

How it was found

On 10 October, developer Roman Zipp was buying a keyboard from a Shopify store when his checkout page loaded on an unfamiliar web address ending in .top. He noticed because his password manager tried to fill in his details on a site it didn’t recognise. He traced the problem to the Hulk Product Options app and wrote up what he found. Shopify removed the code from that store the same afternoon.

Timeline

• 10 October. Hulk Product Options found redirecting shoppers. HulkApps put out a statement the same day.
• 13 October. Selleasy is used in the same way for about seven hours. Logbase says Shopify confirmed removal that afternoon.
• 14 October. Swym says someone made an unauthorised change to the configuration of Wishlist Plus.
• 15 October. More merchants report similar redirects, and a thread on the Shopify Community forum asks “anyone else affected?”
• 16 October. The App Store listings for all three apps show as unavailable. Australian tech outlet iTnews reports that Shopify told one affected store to stay closed with password protection on.
• 18 October. A second wave hits Swym. Swym says this time the attackers used the app’s own access to stores, not merchant staff accounts, and in some cases edited theme files.
• 20 October. Swym pauses Wishlist Plus for all merchants, revokes its Shopify access and changes its credentials. Shopify sends a security notice to app developers.
• 21 October. Swym reports its core systems restored and starts re-enabling merchants in batches.

How the attack worked

The app code installed on stores was not changed. Instead, the attackers changed what the app’s own servers or settings sent to stores.

Many apps have a setting where custom code can be added, and the app loads that code onto the merchant’s store pages. According to Zipp’s analysis and a technical write-up by security firm cside, malicious code arrived this way and did three things:

1. It waited for the shopper to click Checkout, cancelled the click, and sent them to a fake checkout page on a .top web address.
2. The fake page looked like a normal Shopify checkout and sent whatever the shopper typed to the attackers.
3. It then passed the shopper on to the real checkout, so the order still went through.

The code only fired once per browser session. A merchant testing their own store would usually see a normal checkout, which is why many could not reproduce what their customers described.

The fake addresses reported so far include biliing[.]top, checkout-confirm[.]top, order-confirm[.]top, billing-confirm[.]top, account-confirm[.]top, checkout-guard[.]top and checkout-secure[.]top. (The brackets stop them working as links.)

Was card data stolen?

It’s not known. The fake pages were built to collect card and personal details, but no source has confirmed how much, if anything, was taken. Logbase said it had “no knowledge of what information, if any, was provided”. Swym told merchants that shopper data may be compromised for anyone who entered details on the external site.

What Shopify has said

Shopify hasn’t published a public statement for merchants about the incident. A spokesperson told iTnews that apps must meet Shopify’s security standards, and “When an app falls short, we act”. That can include removing an app from the App Store and asking its developer to contact affected merchants.

On 20 October, Shopify posted a security notice to app developers. It doesn’t name the incident or any app. It asks developers to scan their apps for security issues, move to access tokens that expire, treat any data their app puts on a storefront as untrusted, check their API logs, and turn on two-step verification on every account. It also says Shopify plans to tighten limits on app code that runs on storefronts and to raise App Store security requirements, with no dates given.

What the app developers said

• HulkApps said only the Product Options theme extension was affected. It says it removed the code, added stronger authentication, brought in an outside firm, and that the app is safe to use.
• Logbase called it “a deliberate, planned cyber-attack” in its incident notice. It says it fixed the cause within hours, locked the custom code setting, commissioned an outside audit and contacted affected merchants.
• Swym published an incident FAQ telling merchants to turn off Swym’s app embeds, check their theme code for changes made by the app, search for “checkout-guard”, change passwords and turn on two-step verification. It says leaving the app installed while it’s paused is safe, and wishlist data is kept.

What isn’t known yet

• How the attackers got in. None of the three developers has published a root cause.
• How many stores and shoppers were affected. No count has been published. Selleasy alone is used by over 49,000 stores, but that is its user base, not the number affected.
• Whether other apps were involved. Hundreds of apps left the App Store in mid October, but most appear unrelated. One likely reason is a Shopify API version deadline on 16 October. An app missing from the App Store is not, on its own, a sign that it was hacked.

What this means for merchants

The apps used in this attack were popular, well reviewed and had passed Shopify’s review. That is the uncomfortable lesson: an app can be trustworthy when you install it and still be used against your store later, through a problem on the developer’s side.

You can’t fully control that risk, but you can reduce it. Check your store now with our step-by-step guide. Then go through your apps with two questions: do we still use this, and does it need the access it has? Our guides to Shopify app permissions and vetting an app before you install it will help.

Frequently asked questions

Was Shopify hacked?

No. Shopify’s own systems were not breached. The attackers worked through third-party apps that stores had installed.

Which Shopify apps were hacked?

The developers of Hulk Product Options, Selleasy and Swym Wishlist Plus have confirmed their apps were used. Other apps have been named in forums and blogs without confirmation, so treat those lists with care.

Are these apps safe to use now?

HulkApps and Logbase say their apps are safe to use again. Swym is restoring Wishlist Plus in stages. Follow each developer’s own updates, and check your store using our guide before you switch anything back on.

Should I uninstall every app that was removed from the App Store?

No. Many apps were removed in October for unrelated reasons. Uninstall apps you don’t use, and check the developer’s own notices for any app you’re unsure about.