Shopify Checkout Hijack attack redirects shoppers to fake payment pages
A Checkout Hijack campaign identified in October 2026 has affected some Shopify stores through third-party applications. Malicious JavaScript loaded on storefronts can intercept the Checkout action and redirect shoppers to fake payment pages designed to collect card details and personal information. There is currently no evidence that Shopify’s core checkout infrastructure itself was compromised.
A phishing campaign targeting the Shopify ecosystem is creating direct risk for both merchants and customers by interfering with the purchase flow immediately before payment.
The activity was observed from October 10, 2026, when some stores using third-party Shopify apps began loading suspicious JavaScript on their storefronts. When shoppers clicked Checkout, the script could intercept the action and redirect them to an external payment page designed to resemble a legitimate checkout.
Applications confirmed or linked during the investigation include Hulk Product Options, Swym Wishlist Plus and Selleasy. Other applications were also mentioned as the investigation expanded, but the scope and impact were not identical across all cases.
One important distinction is that there is currently no evidence that Shopify’s core checkout platform was compromised. The malicious activity was observed at the storefront and third-party application layer before shoppers reached the legitimate Shopify checkout.
How does Shopify Checkout Hijacking work?
The attack mechanism observed on some affected stores is straightforward but highly effective.
After a shopper adds products to the cart and clicks Checkout, malicious JavaScript can interfere with the click event.
Instead of allowing the browser to continue to the legitimate Shopify checkout, the script may:
intercept the Checkout action;
redirect the shopper to an attacker-controlled domain;
display a fake payment interface;
request personal and payment information;
in some cases, later return the shopper to the legitimate purchase flow.
Domains observed during the investigation included addresses such as:
biliing[.]top
checkout-confirm[.]top
order-confirm[.]top
account-confirm[.]top
billing-confirm[.]top
These domains are not part of Shopify’s official payment infrastructure. One factor making the campaign harder to detect is that redirection does not necessarily occur in every browsing session.
Some application developers reported that the redirect behavior appeared only in a subset of sessions, while certain browsers could block it. A merchant could therefore test checkout several times without reproducing the issue.
How did malicious code reach Shopify storefronts?
The most significant aspect of the incident is the third-party application supply chain. In several analyzed cases, the malicious JavaScript was not directly embedded in the merchant’s Shopify theme.
Instead, code was delivered through APIs or configuration mechanisms controlled by third-party applications. This means a merchant could inspect their theme source code and still fail to find the malicious script because the code was loaded dynamically while the storefront was running.
This means the incident cannot be treated simply as a merchant-side configuration problem.
When a Shopify application is allowed to load JavaScript onto a storefront, the application developer’s infrastructure also becomes part of the merchant’s security boundary.
Which Shopify apps were confirmed to be involved?
As of the updates published in mid-October 2026, three applications were among the most clearly confirmed cases.
Hulk Product Options
HulkApps said that an unauthorized configuration change affected a theme extension and caused some checkout sessions to be redirected to an external payment page.
The application was later removed from the Shopify App Store while remediation was underway.
Selleasy
The developer behind Selleasy confirmed that an unauthorized party gained access to an internal tool and inserted malicious script into the configuration of some stores.
The activity was recorded on October 13, 2026.
The script was subsequently removed, the Custom JavaScript functionality was disabled during remediation, and authentication controls for the internal tool were strengthened.
Swym Wishlist Plus
Swym identified an unauthorized configuration change that caused script injection on a group of storefronts.
Shoppers clicking Checkout on affected stores could be redirected to an external website imitating a payment page. No public evidence has indicated that merchant data stored in Swym’s systems was accessed.
The full scope of the broader campaign has not been disclosed because different application developers reported different timeframes and levels of impact.
What data could shoppers lose?
The immediate goal of checkout phishing is to collect data at the moment shoppers have the least reason to be suspicious: when they are about to pay for a legitimate order.
A fake checkout page may request:
full name;
address;
email address;
phone number;
card number;
expiry date;
card security code;
other payment-related information.
The dangerous part is that the shopper does not necessarily begin from a phishing email or suspicious advertisement.
They may have:
visited the legitimate merchant website;
browsed a real product;
added the item to the real cart;
only then been redirected at Checkout.
That makes this attack model considerably more convincing than many traditional phishing campaigns.
Was Shopify itself hacked?
There is currently no evidence that Shopify’s core checkout system or the entire Shopify platform was compromised. The confirmed incidents have focused on third-party applications and extensions integrated into storefronts.
The incident therefore should not be described as “Shopify was hacked.” A more accurate description is:
Some Shopify stores experienced Checkout Hijacking through third-party applications or configurations that were compromised or modified without authorization.
This distinction matters because it helps businesses identify the correct scope for investigation: not only Shopify Admin accounts, but also applications, APIs, tokens, backend infrastructure and internal administration tools.
Why is this a significant supply-chain risk?
Shopify merchants commonly use multiple applications to add features such as:
wishlists;
product options;
upselling;
search;
popups;
analytics;
marketing;
customer support;
design customization;
automation.
Each application may receive different permissions, and some can load scripts directly onto the storefront. This creates a trust chain:
Merchant → Shopify → Third-party App → App Backend → JavaScript in the Customer’s Browser
If one link in that chain is compromised, an attacker may not need direct access to the merchant’s Shopify Admin account.
The broader concern is that a single application provider may serve hundreds or thousands of merchants. If the provider’s own infrastructure is compromised, the impact can potentially extend across multiple storefronts.
What should Shopify merchants check immediately?
1. Test checkout using a clean browser session
Open an Incognito or Private Browsing window, add a product to the cart and proceed through Checkout.
Verify the domain carefully at every stage. Simply reviewing theme source code may not be enough if the script is dynamically loaded from a third-party API.
2. Review all installed Shopify apps
Identify:
which apps are still necessary;
which apps are no longer used;
which apps can modify the storefront;
which apps can access data;
which apps use the Shopify Admin API.
Unnecessary applications should be removed to reduce the attack surface.
3. Review application permissions and related accounts
Check:
tokens;
API credentials;
application accounts;
employee accounts;
internal administration tools;
integrations connected to Shopify.
Credentials should be rotated if suspicious activity is observed or if exposure cannot be ruled out.
4. Monitor JavaScript loaded on the storefront
Businesses should know which domains and scripts are authorized to run on their websites.
Unexpected changes in third-party JavaScript sources should be investigated.
5. Monitor customer reports
If customers report:
an unusual checkout interface;
unexpected URLs;
requests to enter payment information twice;
redirection to another domain;
the merchant should treat the situation as a potential security incident until the cause has been verified.
Why may simply uninstalling the app not be enough?
Removing an affected application may eliminate the visible symptom, but it does not necessarily answer several important questions:
Where was the original entry point?
Which credentials were exposed?
Were tokens used?
What data did the attacker access?
Are any malicious components still present?
Has the vulnerability that enabled the incident actually been fixed?
For that reason, businesses need to address the active incident, the underlying technical cause and the risk of recurrence.
IPSIP Vietnam solutions for Shopify businesses
For Checkout Hijack incidents, simply uninstalling an application or deleting suspicious JavaScript is not enough to confirm that the environment is secure.
A more appropriate approach is to combine Incident Response, Web/API Penetration Testing and continuous monitoring.
1. Incident Response and impact assessment
When a storefront begins redirecting users unexpectedly or Checkout sends customers to an unfamiliar domain, the first priority is to contain and investigate the incident.
Businesses should:
identify the affected script or application;
review logs and configuration changes;
inspect Shopify tokens, API keys and credentials;
determine whether internal tools or accounts were used without authorization;
remove malicious content;
assess which storefronts and data were affected;
preserve technical evidence for investigation.
The goal is to identify the actual attack path, rather than only removing the visible redirect.
2. Web/API Penetration Testing to identify remaining weaknesses
After containment, IPSIP Vietnam Penetration Testing can be used to assess the components most relevant to this type of incident, including:
Web applications;
APIs;
authentication;
authorization;
session management;
Shopify tokens;
secret management;
internal administration tools;
business logic;
integration permissions;
mechanisms capable of writing or loading JavaScript onto storefronts.
In this context, Pentesting is not only about finding additional vulnerabilities. It also helps determine whether the attack path that enabled the incident can still be exploited.
After remediation, a retest should be performed to confirm that the fix is effective and the weakness is no longer exploitable.
IPSIP Vietnam has previously applied a similar model in the Shopify Incident Response and Pentest case for ShineCommerce – Smind Sections. After abnormal storefront redirects were discovered, the engagement included incident investigation, tracing the path of unauthorized JavaScript, Grey-box Web/API Pentesting and retesting after remediation.
3. Add continuous monitoring after remediation
For organizations operating multiple storefronts, backend systems or third-party integrations, a one-time assessment is not sufficient to identify every abnormal behavior that may emerge later.
IPSIP Vietnam's SOC 24/7 can provide an additional layer of continuous monitoring and alert validation across relevant infrastructure.
How should Shopify businesses strengthen their defenses?
Checklist for merchants
Reduce unnecessary apps.
Review application permissions regularly.
Test checkout flows using a clean browser.
Monitor domains appearing during payment.
Enable MFA for Shopify Admin.
Restrict employee account privileges.
Rotate API keys and tokens when exposure is suspected.
Monitor theme and storefront script changes.
Establish a process for investigating customer reports of abnormal checkout behavior.
Prepare an Incident Response plan before an incident occurs.
Checklist for Shopify app developers
Do not store secrets in frontend code.
Do not allow internal tools to write scripts without strong authentication.
Apply Least Privilege to Shopify tokens.
Review APIs capable of modifying storefront behavior.
Avoid Custom JavaScript functionality unless it is genuinely required.
Log all sensitive configuration changes.
Require MFA or step-up authentication for administrative actions.
Perform regular Web/API Pentesting.
Retest after remediation.
Maintain an Incident Response plan specifically for supply-chain incidents.
IPSIP Vietnam's expert perspective: what is the main lesson from Checkout Hijacking?
Every Shopify application capable of modifying storefront behavior should be treated as part of the organization’s software supply chain. Installing an application effectively extends the merchant’s trust boundary beyond Shopify itself.
Checkout Hijacking demonstrates that a legitimate storefront can still become a delivery point for phishing if one component in the application supply chain is compromised.
For Shopify applications used by large numbers of merchants, a weakness in backend infrastructure can potentially extend the impact across multiple storefronts.
Reducing unnecessary third-party dependencies, controlling privileges, monitoring storefront behavior, preparing incident response procedures and performing regular Web/API security testing are important defensive layers for reducing the risk of similar incidents.
References
