Shopify Checkout Hijack Through Apps (Oct 2026): What to Check

In October 2026 some Shopify shoppers clicked Checkout and landed on a page that looked like a payment page but was not Shopify’s. Merchants found out from customers, from chargebacks, or from a developer’s blog post. Many asked the same question: was Shopify hacked?

From what is public so far, the answer is no. The attackers went through third-party apps installed on the stores. This post sums up what is known as of October 21, 2026, and gives you a checklist you can run on your own store in about fifteen minutes.

What happened

On October 10, developer Roman Zipp reported a checkout hijack on a store he was buying from. He traced the redirect to a script loaded by an app’s storefront extension. The extension asked the app developer’s server for the store’s settings. Those settings carried a block of custom JavaScript, and that block had been replaced with code that caught the click on the checkout button and sent the shopper to a lookalike domain.

The fake pages sat on throwaway domains such as checkout-confirm.top and order-confirm.top. The script also remembered, per browser session, that it had already redirected the shopper, so a second try often worked normally. That makes the attack hard to reproduce and easy to miss.

Over the following days more apps were affected in the same way. Zipp keeps a page of the developers’ statements. Australian press reported one store that stayed closed for days while it was reviewed.

Which apps have confirmed it

Lists of “affected apps” are circulating on Reddit and in the Shopify Community. Many entries are guesses from one merchant. We list only incidents the app’s developer has confirmed in a public statement:

App	When	What the developer said
Hulk Product Options (HulkApps)	October 10, 2026	An exploit put unauthorized configuration into the app; the code was removed and an outside firm was hired for incident response
Selleasy (Logbase)	October 13, 2026	Someone got into an internal Selleasy tool and used it to add a script to store settings; no sign of a database breach so far
Swym Wishlist Plus	October 14, 2026	An unauthorized change to the app’s configuration loaded a script on some storefronts; Swym disabled the app and rotated its Shopify credentials
Qikify	July 2026	Malicious code was placed in two custom HTML fields in app settings, believed to come from a stolen credential

You may also see posts saying that more than a hundred apps disappeared from the App Store in the same week. One write-up found an archived snapshot marking 126 apps as delisted, many of them dated October 15. That snapshot runs to October 19, and more listings have gone since. On October 21, for example, the 17TRACK Order Tracking listing read that the app “is not currently available on the Shopify App Store”. Neither 17TRACK nor Shopify had said why at the time of writing. If you use it, ask 17TRACK directly and run the checks below. A delisting is not proof of a hack: Shopify also removes apps for policy reasons and for missed API version deadlines, and it has not published one list tying these removals to the attack.

Other apps have been named in merchant reports without a confirmation from their developer. If an app you use is on such a list, ask its developer directly and run the checks below. Do not assume it is safe or unsafe from a forum post.

Was Shopify itself breached?

There is no public evidence of that. In the confirmed cases, the attacker changed what an app sent to the storefront: a setting, a custom script field, a configuration file on the developer’s side. Shopify’s own checkout was not modified. The shopper was simply sent away from it before they reached it.

That matters for what you do next. Changing your Shopify password does not remove a script that an app is still loading. You have to find and stop the script.

The 15-minute check for your store

1. Test checkout as a stranger. Open a private browser window, add a product, press Checkout. The address bar should show your store’s domain or Shopify’s checkout, never an unknown domain. Repeat on a phone, and from the cart drawer as well as the cart page.
2. List your apps. In Settings > Apps and sales channels, write down every installed app. For each one, ask: do we still use it?
3. Remove what you don’t use. An app you no longer use can still load code on your storefront. Uninstall it. Then check the theme editor under App embeds and turn off embeds you don’t recognize.
4. Check apps that accept custom code. Product options, wishlists, upsells, pop-ups and bundles often have a “custom JS” or “custom HTML” field. Open those settings and look for code nobody on your team wrote.
5. Look at your theme code. In the theme editor’s code view, search for <script tags that point to domains you don’t know. Check theme.liquid first.
6. Secure the accounts around the store. Turn on two-step authentication for every staff account, remove staff and collaborator access you no longer need, and change the passwords of your accounts on the app developers’ own dashboards.
7. Ask your app developers. If an app was named anywhere, email its support and ask whether your store was in scope and for which dates.

If you see a fake checkout, take screenshots and note the time before you change anything. Contact Shopify Support, disable the app you suspect, and test again. If customers paid on a fake page during that window, tell them so they can contact their bank.

Why this keeps happening

Most apps that change your storefront do it through an app embed or an app block. That is the normal, supported way. But some of them also load extra code from the developer’s server at runtime, for example a custom script a merchant typed in the app’s settings. Whoever can change that server-side setting can change what runs on thousands of storefronts at once.

So the weak point is often not the app’s code on Shopify. It is the developer’s admin panel, an internal support tool or a staff password. One stolen login can reach every store that uses the app.

We cover how to judge an app’s risk before you install it in how to check a Shopify app’s security.

If you build apps

If you run a public or custom app, this incident is a reason to look at your own setup this week:

• Treat any setting that can hold JavaScript or HTML as code. Limit who can edit it, log every change and alert on changes outside office hours.
• Put two-step authentication on every internal tool and support dashboard, not only on the main login.
• Keep an audit trail that tells you which stores received which configuration, and when.
• Have a way to switch off remote configuration for all stores at once.

Talk to us

The team behind StoreFleet, Shopify app developers since 2021, reviews custom apps other developers built: how they load code, who can change their settings, and which credentials they hold. Our post on custom options after the checkout hijack compares the routes we offer. The page on hiring Shopify app developers explains what we take on, and you can send a short brief from there.