Shopify checkout hijack: a 5-minute check to see if your store is sending shoppers to a fake checkout
In October 2026 several popular Shopify apps were used to redirect shoppers to a fake checkout page that captured card details and only then forwarded the shopper to the real checkout. The Shopify platform itself was not breached - the problem sat on the app side.
Three apps are already back in the App Store, but there is still no official Shopify statement about the incident. That leaves the check to the store owner - and it takes about five minutes.
What is the Shopify checkout hijack attack?
The Shopify checkout hijack is an attack in which a legitimately installed app receives foreign JavaScript through its own settings and redirects the shopper to a fake checkout page. The first case was publicly documented on October 10, 2026.
The mechanics matter here, because they explain why the usual checks showed nothing. This was a supply chain attack: the app's own file was unchanged and loaded from Shopify's CDN, so neither a theme code review nor the app's update history revealed anything.
The code arrived later - once the app had loaded and requested its settings from the vendor's server. The response carried roughly 22 KB of foreign code in a field meant for the store owner's own custom JavaScript (security researchers published a detailed technical analysis of the attack). It intercepted the click on the Checkout button, took the shopper to a near-identical page on a foreign domain, harvested card and personal details, and then forwarded them to the real checkout.
Most shoppers never noticed anything was wrong, because the order went through in the end. And the owner saw nothing either, because the redirect fired only once per session - checking a second time simply did not reproduce it.
Which Shopify apps were affected?
Three apps are publicly confirmed: Hulk Product Options (HulkApps) on October 10, 2026, Selleasy (Logbase) on October 13, and Swym Wishlist Plus (Swym) on October 14. All three have tens of thousands of installs.
Logbase was the most specific about what happened:
"An unauthorized party gained access to an internal Selleasy tool" - Logbase, incident on October 13, 2026, 07:47-15:00 UTC (summary of vendor statements)
HulkApps refers to "an exploit" and states that the app is now "fully functional and safe to use". Swym mentions "an unauthorized change to the app's configuration" and an ongoing investigation. None of the vendors published how many stores were affected.
Earlier in the same year there were two separate, already resolved incidents with a similar signature: Qikify's apps (Sticky Add to Cart, Mega Menu) on July 22 and Hextom's apps in August. They are not officially linked to this campaign, but the pattern is the same - code injected through app settings rather than through the app itself.
How do you check whether your Shopify store is affected?
The check takes about five minutes and needs no developer. The key rule: from cart to payment, the address bar must stay on your own domain or shopify.com - nothing else.
- Open your store in a fresh incognito window, add a product to the cart and click Checkout. Repeat 3-4 times, each time in a new window, because the redirect fires only once per session.
- Repeat the same test on a phone and from the cart drawer, not only from the cart page.
- Check that no unfamiliar domain appears in the address bar and that the checkout page looks exactly as it normally does.
- In the theme editor, open your app embeds and turn off every one you no longer use.
- Review every app settings field that accepts custom JavaScript or HTML. Any code there that you did not enter yourself is suspicious.
How do you check precisely?
A more technical but more reliable method: in your browser's DevTools, open the Application tab and Session Storage. This attack used a marker whose name starts with __ctf_. If such an entry exists on your store, treat it as a confirmed case.
What should you do if you find the checkout redirect in your store?
If the check reveals a redirect to a foreign domain, the first step is not to disable the app but to preserve evidence - both the vendor and your payment provider will need it.
- Take screenshots and note the exact time and the domain you were redirected to.
- Disable the suspected app and its embed in the theme.
- Contact the app vendor in writing and open a case with Shopify Support.
- Notify your payment provider - they are the ones who will tell you whether anything is required regarding your customers' cards.
- Change your Shopify and app account passwords, enable two-factor authentication, and review who still has collaborator access to the store.
On notifying customers and your data protection authority, consult a lawyer - the answer depends on how much data actually leaked. We are not a law firm and will not assess that for you.
Why this matters even if you do not use these apps
Black Friday is a few weeks away, and this is exactly when stores install new promotion, discount and calculator apps en masse. Every one of them with a free JavaScript field or a theme embed is the same attack surface, regardless of how well known the vendor is.
The practical fix is simple and costs nothing: before your highest-traffic weekend, disable every app you do not actually use and verify that its embeds and leftover theme snippets went with it. While you are there, it is worth reviewing your other discount settings before Black Friday.
Part of that list is not something an owner will catch alone - leftover theme snippets, unused embeds and collaborator access accumulated over the years are a standard part of a Shopify store audit.
Frequently asked questions
Has Shopify officially announced this attack?
No. As of November 6, 2026 there was no public Shopify statement about the incident. All that is known is that Shopify temporarily disabled the HulkApps theme extension and later restored it.
Is it safe to keep using Hulk Product Options, Selleasy and Swym Wishlist Plus?
All three apps are back in the Shopify App Store and the vendors state the root cause is fixed. Logbase has so far only promised a detailed incident report and a forensic audit.
Was Shopify's own checkout compromised?
No. The redirect fired on the storefront before the shopper reached Shopify's payment step, so Shopify checkout data was never accessed.
Would Shopify's security tools in the admin have flagged this attack?
No. The code lived neither in the theme nor in the app's file, but in the app's settings on the vendor's server, so no warning appeared in the admin.
If you are not sure whether unused app embeds or foreign code in settings fields are still sitting in your store, get in touch and we will check it with you.
