Key takeaway: Merchants running third-party Shopify apps should review installed extensions and custom code now. Attackers reached shoppers through app configuration channels, not through Shopify’s own checkout. The injected scripts sent shoppers to fake payment pages that captured card data. The fake pages then forwarded shoppers to the real checkout. A password reset alone will not close that gap. Merchants need a full audit of installed apps and custom code.
Three Shopify app developers have confirmed that attackers used their apps to send shoppers to fake payment pages. The affected apps are Selleasy by Logbase, Swym Wishlist Plus by Swym, and Hulk Product Options by HulkApps.
Separately, Shopify delisted 478 apps from its App Store between October 14 and October 22, 2026. The count comes from Revenue Shield, a vendor that sells Shopify checkout monitoring, using archive data from heyapps.dev. Shopify has not confirmed the figure or explained most of the removals.
German developer Roman Zipp uncovered the campaign on October 10, 2026, while shopping on a Shopify store. When he clicked Checkout, the store sent him to a lookalike payment page instead of Shopify’s checkout. The fake page sat on biliing[.]top and requested payment and personal details. It then forwarded shoppers to the genuine checkout, so their orders completed normally.
The script fired only once per browser session. Merchants testing their own stores often saw a clean checkout while new visitors hit the fake page.
Logbase said an unauthorized party gained access to an internal Selleasy tool. The attacker used it to add a malicious script to the Selleasy settings of a number of stores. The script ran from 07:47 to 15:00 Coordinated Universal Time (UTC) on October 13, iTnews reported. One affected merchant, Australian dog harness retailer WAGD, stayed closed on Shopify’s advice until October 19.
HulkApps said unauthorized configurations altered the Hulk Product Options theme extension. Zipp traced the payload to a custom JavaScript field that the app pulled from HulkApps’ servers. Shopify temporarily disabled the extension while HulkApps removed the code.
Swym said malicious code reached some storefronts through Swym Wishlist Plus. The company reported a second wave of activity on October 18 that used the app’s own Shopify access. Swym then paused the app for all merchants and revoked its Shopify credentials on October 20.
Shopify’s App Store listed all three apps as unavailable from October 15. Delisting blocks new installs, but the apps keep running on stores that already have them.
Removals peaked on October 20, when 305 apps left the App Store in a single day. Revenue Shield’s tracker shows no public reason for most removals. Shopify told iTnews on October 17 that every App Store app must meet its security and privacy standards. The company said it acts when apps fall short, including by delisting them.
Separate reports also named 17TRACK Order Tracking, Consentmo GDPR Compliance, Boost AI Search & Filter, and Privy. None of those developers has confirmed involvement in the hijack. Boost and Privy have described unrelated service disruptions on their status pages.
Why it matters: Attackers reached merchants’ checkouts without breaching Shopify’s systems or merchant logins. One compromised app vendor can push code to every store that runs its app. A routine app install becomes a channel for card-data theft. Merchants should test checkout in a private browser window and check app settings for code their team did not add. The incident also raises hard questions about chargebacks and fraud losses. Who absorbs those costs when the breach traces back to a vendor’s app?
Sources: Revenue Shield, iTnews, and Astra