Security notice
Your Shopify checkout button may have sent shoppers to a fake page. Test it today.
In October 2026, code delivered through three Shopify apps, Hulk Product Options, Selleasy and Swym Wishlist Plus, sent some shoppers who clicked checkout to a fake checkout page on an outside website, built to collect their card details. All three app developers have confirmed incidents. There is no sign Shopify itself was breached, so there is no CVE. The danger: the fake page can hand shoppers back to your real checkout, so orders look normal while card details went elsewhere. If you sell on Shopify, test your checkout today, even if you never installed these apps.
What happened
- October 10: Hulk Product Options. Developer Roman Zipp found a store's checkout button sending him to a fake checkout page and traced it to code returned by the app's own servers. HulkApps says an exploit introduced unauthorized configurations into the app that day and redirected some checkouts to a fake external checkout page. (Roman Zipp, HulkApps statement)
- October 13: Selleasy. Logbase, which makes Selleasy, says it was the victim of a deliberate, planned cyber attack in which an unauthorized script was injected into some of the stores it serves and redirected customers to a phishing page. (Logbase)
- October 14: Swym Wishlist Plus. Swym says that between about 10:06 and 11:56 UTC an unauthorized party changed the app's configuration so a script loaded on a limited subset of storefronts. Shoppers who clicked checkout on affected pages may have been sent to a website "designed to imitate a checkout page and collect payment card details." (Swym)
- A second Swym incident. Swym later said new attempts were made to add malicious code to storefronts through the app, this time using the app's own access to stores. It paused Wishlist Plus for every merchant and revoked its Shopify access. Letsmetrix and Fudge date this second wave to October 18. (Swym FAQ, Letsmetrix)
- The fake pages were on look alike web addresses ending in .top. (Roman Zipp, Swym FAQ)
- Shopify's response. On October 20 Shopify asked every app developer to act on its security steps "this week" and added a prompt asking shoppers to confirm before a store sends them to an outside website. (Shopify developer post, Shopify Changelog)
- How big is it? No one has published a count of affected stores. Letsmetrix says Selleasy alone is installed on more than 49,000 active stores, though that is not a count of stores hit. (Letsmetrix)
Who should worry
Every Shopify store owner, and every agency that builds or runs Shopify stores, should check. Be most concerned if:
- You use, or used this month, Hulk Product Options, Selleasy or Swym Wishlist Plus.
- You use any app that can add custom JavaScript or HTML to your storefront. Letsmetrix says every confirmed case abused a setting like this.
- A shopper has told you about an extra payment page, a payment error before checkout, or card fraud after buying from you.
Not using these apps does not clear you. Store owners have reported the same redirect on stores running none of the three, with no cause identified yet. (Roman Zipp, Letsmetrix)
What to do now
Do these today.
- Test your checkout. Open a new private or incognito browser window, add an item to the cart and click checkout. You should stay on your own store address or Shopify's checkout. Repeat in another fresh private window, because Roman Zipp found the script only fires once per visit. (Roman Zipp, Letsmetrix)
- Follow your app developer's instructions. If you use Swym Wishlist Plus, Swym says the app is paused for every store and is safe to leave installed while paused. Do not rush to uninstall apps: Letsmetrix warns that uninstalling may not remove every change an app made to your theme. (Swym FAQ, Letsmetrix)
- If you find a fake checkout, put your store behind its password page, save screenshots with the time, and contact Shopify Support and the app developer. Never enter real card details on it. (Letsmetrix)
- Think about your customers. Swym says customer data may have been compromised if shoppers typed their details into the fake page, and that you may have duties to notify shoppers, regulators or your payment processor. (Swym, Swym FAQ)
- Turn on two step login for your Shopify account and every app account that can change your store.
What to send your developer, agency or host
In October 2026, code delivered through Shopify apps Hulk Product Options (October 10), Selleasy (October 13) and Swym Wishlist Plus (October 14 and a second wave reported October 18) sent some shoppers to fake checkout pages on .top web addresses that collected card details. Store owners have also reported redirects on stores without these apps. Please today: test our checkout in several fresh private browser windows; check what every app that can add custom JavaScript or HTML to our storefront is loading; and search our theme files for app edits we do not recognize, for checkout-guard and for any .top address. Tell us what you find before removing anything, so we keep evidence. Sources: Swym, Logbase, Shopify developer post, Letsmetrix.
Technical steps
Step 1. Watch the checkout click
In a private window, open browser developer tools with the network log set to keep entries between pages. Go from a product page to cart to checkout. Every request and the final checkout address should belong to your store, Shopify or a vendor you know. Look for any .top address. (Letsmetrix)
Step 2. Check browser storage
In developer tools, open Application and look in session and local storage for keys starting with __ctf_, which the script used to mark visitors already redirected. (Roman Zipp)
Step 3. Check theme files and app embeds
In Shopify admin, open Online Store > Themes > Edit code. Look for file edits made by an app that you do not recognize and search all files for checkout-guard. Shopify keeps older versions of each file, so you can restore one after saving evidence. Then open Customize > App embeds and confirm you recognize every embed that is switched on. (Swym FAQ, Letsmetrix)
Step 4. Check apps that accept custom code
List every app with a custom JavaScript, code or HTML setting and review what it contains. (Letsmetrix)
Common questions
Has my business been hacked?
This notice does not mean your store has been hacked. Swym says "All impacted stores are being contacted directly." (Swym FAQ) Redirects have also been reported on stores without these apps, so the way to know is to test your checkout and check your theme files today.
My orders look normal. Does that mean I am fine?
Not necessarily. When Roman Zipp filled in the fake page with made up details, it passed him on to the store's real checkout, so a shopper can be caught and still place a normal order. (Roman Zipp)
Can EverThread tell me if I am affected?
Not reliably. EverThread checks your pages from the outside, the way a browser sees them. On the pages we check, we may notice some warning signs, such as a page sending visitors to another site or a form sending data somewhere else. We do not see your Shopify checkout or the code inside your apps, and this script was built to fire only once per visitor, so no warning from us does not mean your store is clean. Test your checkout as described above. Our guides on a page that sends visitors to another site, a form that sends data to another site and scripts from other companies explain the signs.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Swym: Security Incident Update (October 14 incident)
- Swym: Wishlist Plus Security Precaution: Frequently Asked Questions, October 20, 2026
- Logbase: Selleasy service status, updated October 16, 2026
- Roman Zipp: Shopify shops hit with ongoing Checkout Hijack attack, updated October 22, 2026 (includes HulkApps' and Selleasy's statements)
- Shopify: Securing your app, together, October 20, 2026
- Shopify Changelog: New protection against unexpected redirects, October 20, 2026
- Letsmetrix: Shopify checkout hijacking (October 2026), October 20, 2026 (independent tracker)