Attackers abused the vendors behind Hulk Product Options, Selleasy and Swym Wishlist Plus in October to redirect Shopify shoppers to lookalike payment pages that collected card details. Seiko pulled the Swym app from its Japanese stores on October 30. If you sell on Shopify, run a checkout test and check your apps.
If you run a Shopify store, open it in a private browser window today, add something to the cart and click Checkout. The address bar should stay on your store’s domain or Shopify’s checkout. In October, attackers got into the vendors behind at least three popular Shopify apps and used the apps’ own access to send shoppers to lookalike payment pages that collected card details. Orders could still look normal on your side.
What changed
Three app makers have published incident notices. All times UTC.
- Selleasy (Logbase), October 13. Logbase’s incident report says an attacker reached a legacy internal support tool and, from 07:47, injected a script into Selleasy storefronts that redirected some shoppers during checkout. Logbase disabled custom scripts across all stores at 12:22 and removed the script by 15:58. It says merchants’ Shopify accounts were not used. Selleasy returned to the Shopify App Store on October 27.
- Swym Wishlist Plus, October 14. Swym’s security update says an unauthorized party changed the app’s configuration between about 10:06 and 11:56, which loaded a script on some storefronts. Shoppers who clicked checkout on affected pages may have been sent to a site imitating a checkout page to collect card details. Fixes were fully live by 16:32. Swym says it found no evidence that merchant accounts or Swym-stored data were accessed.
- Hulk Product Options (HulkApps), around October 10. iTnews reported that unauthorized configurations altered the app’s theme extension and that HulkApps called it part of a global campaign. Developer Roman Zipp first documented the redirect on October 10 after a checkout on a keyboard retailer’s store landed on a fake page.
The newest development: Seiko published a notice dated October 30 saying it removed Wishlist Plus from its Grand Seiko Boutique Online, Seiko Online Store and Seiko Clock Online Store, all in Japan. Seiko says it has found no leak of customer data and is still checking whether its stores were affected.
According to Zipp’s analysis, the fake page posted the details a shopper typed to the attacker’s server and then forwarded the shopper to the store’s real checkout, so the order went through. A Shopify spokesperson told iTnews that every app must meet its security standards: “When an app falls short, we act.” No report says Shopify’s own systems were breached. No vendor has published how many stores or shoppers were hit.
What store owners should do
1. Run a checkout test. Use a private window, on desktop and on your phone. Start checkout from the cart page and from the cart drawer. Watch the address bar as the payment page loads. Any unfamiliar domain is a red flag. Don’t type real card details.
2. Check your apps. Look at Settings, then Apps, and at the App embeds panel in the theme editor. If you use Hulk Product Options, Selleasy or Wishlist Plus, read the vendor’s notice and confirm the app’s current status before you turn anything back on.
3. Search your theme code. Zipp lists the fake domains seen so far, including biliing.top, checkout-confirm.top, order-confirm.top, billing-confirm.top and checkout-guard.top, and session storage keys starting with __ctf_. A theme search won’t catch a script delivered through an app’s settings, so the checkout test still matters.
4. Tighten store access. Remove apps and collaborators you no longer use, and make sure every staff account has two-step login.
5. Ask about notification duties. Swym tells merchants to review state breach-notification laws and payment processor terms with their advisors if shoppers were redirected. Contact the app vendor and your payment processor if a customer reports an odd payment page.
Shoppers: if a store’s payment page showed a different web address than the store’s in mid-October, call your card issuer and ask for a new card.
Every app you install can rewrite your checkout
No report says Shopify’s own checkout was breached. The weak point was the small apps that load code on the pages before it. A wishlist button or an upsell widget looks harmless, but it runs on every product page and can change where the Checkout button goes. When its maker’s internal tools or settings are compromised, every store using it inherits the problem at once.
For a small brand, the practical rule is fewer apps, each one reviewed. Every app you add is a vendor with a path to your customers’ card details. This is the same pattern as the Northflank breach and the backdoored Claude Code extension in Cursor: the attack came through a trusted tool, so the buyer’s only defense was checking what that tool could reach.