Shopify Checkout Hijack: What Happened and How to Check Your Store

What Is the Shopify Checkout Hijack?

Some Shopify stores install apps that load extra code on the storefront. In October 2026, attackers changed the settings of a few of those apps, and the changed settings added a script that ran when a shopper clicked Checkout.

The script sent the shopper to a lookalike payment page first. After the shopper typed their details, it forwarded them to the real Shopify checkout. The order completed, so neither side noticed.

Was Shopify hacked? Reports say no. Merchant Fraud Journal reports that the attackers reached merchants' checkouts "without breaching Shopify's systems or merchant logins"; the attack came through the app companies' settings. We didn't find a full public statement from Shopify. The only Shopify comment we found is a paraphrase: Merchant Fraud Journal reports Shopify told iTnews on October 17 that apps in its store must meet its security and privacy requirements, and that it delists apps that fall short. Check Shopify's announcements for updates.

Timeline: What Is Known

Company statements say the apps are fixed — Selleasy's says "Selleasy is safe to use." These are claims by the companies, so verify before you trust them again. How the attackers got in is not confirmed for Hulk. Selleasy says "an internal tool." Swym says an "access channel" that has since been secured. The number of affected stores and shoppers has not been published.

How Did the Fake Checkout Work?

• Settings, not files. The app's storefront file asked the app's own server for its settings. In the Hulk case, the answer included about 22.7 KB of custom JavaScript, which the page then ran.
• The redirect. The script watched for the Checkout click and sent the shopper to a lookalike domain. The researcher listed examples such as biliing[.]top and checkout-confirm[.]top.
• Once per session. The script stored a marker in the browser so it ran once per session. A store owner testing their own checkout often saw nothing wrong, while a new visitor was redirected.
• Then the real checkout. After the fake page, the shopper was sent on to the real checkout. Whether real customer data was stolen at scale is not established. Swym says it does not collect, process or store card data, and found no evidence that merchant accounts or stored data were accessed.
• Hidden in a label. In the Swym case, Astra Security's write-up says a setting that should have held a wishlist label instead carried HTML with an event handler that triggered the redirect.

How Do You Check Your Shopify Store? (5-Minute Test)

1. Open a private window. The attack ran once per session, so use a fresh window each time.
2. Add a product and click Checkout.
3. Read the address bar. You should land on your store's real checkout. Any unfamiliar domain, especially strange endings like .top, is a red flag.
4. Repeat in a second fresh window and on your phone. One clean test does not prove you're safe.
5. Clear browser storage between tests. Astra's write-up notes that disabling the app didn't immediately stop the behavior, because the settings were cached in the browser.

How Do You Audit Your Apps?

1. In Shopify admin, open Settings → Apps and sales channels and list every app.
2. Remove apps you don't use. Fewer apps means fewer places for code to hide.
3. Check custom-code fields. For each app that changes the storefront, open its own dashboard and look for Custom JavaScript or Custom HTML fields. Astra's write-up calls these the specific attack surface the Hulk case exploited. Remove anything you didn't add yourself.
4. Review App embeds in your theme editor, and switch off what you don't need.
5. Remove old staff and contractor access.

What Should You Do If You Find a Redirect?

This is our advice, based on the sources below.

1. Stop selling through the affected path. Disable the suspected app's embed. Don't uninstall before saving evidence: screenshot the address bar and note the time.
2. Contact Shopify Support and the app's vendor.
3. Change passwords for your Shopify account and each app account, and turn on two-step sign-in (a passkey or an authenticator app).
4. Call your payment processor. You may have duties to notify them and your customers. Swym's own guidance was that merchants may want to notify shoppers who typed card numbers directly into checkout during its affected window (10:06–16:32 UTC on October 14). Shop Pay, PayPal and Google Pay were not affected in the same way, per Swym. This is not legal advice.
5. Report the fake domain to Google Safe Browsing.

If shoppers dispute charges afterwards, chargebacks can follow — and rising chargeback activity is one of the signals Shopify lists for placing a reserve on your payouts. If a payout is already on hold, start with why your Shopify payout got put on hold.

How Do You Prevent This Next Time?

What This Means for Dropshipping and New Stores

New stores often install many apps fast — reviews, wishlists, upsells, option pickers. Each one is another company with access to your storefront. Start with a short list, and add an app only when it earns its place.

If you sell on TikTok Shop as well, the risk there is speed rather than code: see our guide to TikTok Shop late dispatch rate.

Need help setting up a clean, safe Shopify store? See our Bespoke Shopify Storefronts service, or message us on WhatsApp.

Sources

• Roman Zipp — Shopify shops hit with ongoing Checkout Hijack attack (published October 10, 2026; last updated October 22)
• Roman Zipp — Statements from Companies involved in Shopify Checkout Hijack (October 19, 2026)
• Merchant Fraud Journal — Hijacked Shopify Apps Redirected Shoppers to Fake Checkouts (October 26, 2026)
• Astra Security — Inside the HulkApps Shopify Checkout Hijack (October 20, 2026; updated October 23). A security vendor's secondary technical analysis.

Last reviewed: November 1, 2026, by Rafail Kazmi, Ecomistryy.

This article is general information, not legal or security-incident advice. Details may change as vendors and Shopify publish more.