# Shopify Checkout Hijacked? What to Check Now {#post-title}

By [B2B Gold](/about/#how-we-write) Published 21 October 2026

## Was my Shopify checkout hijacked by an app? {#was-my-shopify-checkout-hijacked-by-an-app}

In October 2026, the developers of three third-party Shopify apps said an unauthorised party used their apps to add code to some stores that could send shoppers who pressed Checkout to a fake card-payment page. To check, review App embeds and installed apps, search theme code and test checkout in a private window. A clean test is not proof.

The incident was still open at 04:37 UTC on 21 October 2026, so each fact below carries its source’s date. Shopify labels here are the desktop admin’s, checked against Shopify’s help that day.

## What should I check on my store? {#what-should-i-check-on-my-store}

Check five things: email from your app developers, App embeds in each market, each app’s access and extensions, your theme code, and the Checkout button in a private window.

| Check | Where | What you’re looking for |
| --- | --- | --- |
| Email from your app developers | Your inbox | A notice that your store was affected |
| App embeds | **Online Store** → **Edit theme** → **App embeds**, in each **Market** | An embed you don’t recognise or no longer use |
| App access and extensions | **Settings** → **Apps** → each app | Theme or broad access, or **Online Store** extensions, you no longer need |
| Theme code | **Online Store** → **Edit code** → search | The search terms listed under Theme code |
| The Checkout button | A fresh private window | A payment page on an address that isn’t your store’s or Shopify’s checkout |

## What happened to Shopify stores in October 2026? {#what-happened-to-shopify-stores-in-october-2026}

As of 04:37 UTC on 21 October 2026, the developers of Hulk Product Options, Selleasy and Swym Wishlist Plus have each said an unauthorised party used their app to put code on some stores, on different days. Swym says its incident is ongoing, and Shopify has published no incident statement of its own.

- **Hulk Product Options.** An independent developer’s [analysis](https://romanzipp.com/blog/shopify-hit-with-phishing-attack) records a redirect live on a store on 10 October 2026, traced to a function named “hijack” in code the app’s extension loaded from HulkApps’ servers. HulkApps said in a LinkedIn post, quoted by [iTnews](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693) on 16 October, that “unauthorised configurations altered the Hulk Product Options theme extension”, that Shopify temporarily disabled the extension while the code was removed, and that it has since tightened authentication and brought in outside investigators.
- **Selleasy.** Logbase, its developer, says that on 13 October an unauthorised script was injected into some stores it serves and redirected customers to a phishing page outside its environment ([Logbase, last updated 16 October](https://www.logbase.io/selleasy/updates/incident-20261013)). Its notice to merchants, quoted by iTnews, says the attacker used an internal Selleasy tool to add the script to the app’s settings. iTnews puts the attack at 07:47 to 15:00 UTC, and reports Logbase saying Shopify confirmed removal by email at 15:40 UTC. Logbase says it has found no evidence of a data breach or leak on Selleasy’s backend or database.
- **Swym Wishlist Plus.** Swym says an unauthorised party changed the app’s configuration on 14 October, between about 10:06 and 11:56 UTC, so that a script loaded on certain pages of “a limited subset of storefronts”; shoppers who clicked the checkout button there may have reached a site imitating a checkout to collect card details ([Swym, 16 October](https://www.getswym.com/resources/security-response)). It says its fixes were fully deployed by 16:32 UTC, that it does not handle card data, and that it found no evidence that merchant accounts or data it stores were accessed. In an FAQ dated 20 October it said attempts had been made over the past week to add malicious code through the app, and that it had paused the app for all merchants ([Swym incident FAQ](https://www.getswym.com/resources/wishlist-plus-incident-faq)). At 03:35 UTC on 21 October its [status page](https://status.getswym.com/) still described an ongoing incident, with restored services “progressing in planned phases”.

iTnews reported on 16 October that an Australian store hit on 13 October stayed closed after Shopify’s support asked it to keep password protection on; on 19 October it reported the owner saying Shopify had told her the store could reopen. On 21 October 2026 all three apps’ App Store listings read “This app is not currently available on the Shopify App Store”, with no reason given.

**Checkout redirects through Shopify apps, as each source dated them**

1. Wed 22 Jul **Qikify fixes redirects in two of its apps** According to Qikify.
2. Sat 10 Oct **Redirect found through Hulk Product Options** According to an independent analysis.
3. Tue 13 Oct **Script added through Selleasy settings** 07:47 to 15:00 UTC, according to iTnews.
4. Wed 14 Oct **Swym Wishlist Plus configuration changed** About 10:06 to 11:56 UTC, according to Swym.
5. Tue 20 Oct **Swym says Wishlist Plus is paused** For all merchants, in its FAQ dated 20 October. Shopify asks every app developer to act on security steps that week.

## What is still unknown? {#what-is-still-unknown}

As of 21 October 2026, nobody has said how many stores or shoppers were affected, what data was taken, or exactly how the attackers got in, and Shopify has commented on the incident only through a spokesperson.

- **How many stores.** Logbase did not say, according to iTnews. Swym says “a limited subset”.
- **What was taken.** Logbase and Swym say the fake page was outside their systems. A Logbase spokesperson told iTnews it has no knowledge of what information, if any, customers entered there, as the page is outside its systems; Swym says customer data may have been compromised where shoppers reached the external site and typed in their details. No forensic report has been published.
- **Unexplained cases.** A merchant on the [Shopify Community](https://community.shopify.com/t/customers-redirected-to-cloned-checkout-that-captures-card-details-anyone-else-affected/700903) reported on 19 October a redirect on three stores, could not reliably reproduce it and had not found its source.
- **Shopify’s status page.** [Shopify Status](https://www.shopifystatus.com/) lists no incident for this (checked 21 October 2026).

## How does the fake checkout work? {#how-does-the-fake-checkout-work}

In the cases described below, the redirect sends a shopper from your cart to a payment form on another domain, takes the card details, then passes the shopper on to your real checkout. Because the shopper ends up on the genuine checkout, the Community merchant says, orders can look normal in your admin. In our reading, every developer statement cited here, and the independent analysis, describes code on the storefront that sent shoppers to another site (the analysis, Swym and Qikify tie it to the Checkout button); none reports a change to Shopify’s checkout itself.

In the independent analysis, the payment form sat on biliing[.]top rather than the store’s checkout; details submitted in the test were posted to that site before the browser moved on to the correct checkout. The Community merchant described the same pattern on 19 October: the fake page’s code, which the merchant retrieved, showed the shopper’s real basket and was designed to collect card and billing details, display a payment error and then send the shopper to the genuine Shopify checkout. Qikify says a similar redirect through two of its apps on 22 July 2026 “could easily go unnoticed” because customers ended up on the real checkout ([Qikify security notice](https://qikify.com/pages/security-incident-notice)).

It does not fire every time. The analysis found the script ran once per shopper and shop, marked in session storage, and Logbase said the redirect did not succeed on every visit and was blocked by some browsers (iTnews, 16 October).

## How can I tell if my store was affected? {#how-can-i-tell-if-my-store-was-affected}

You can’t rule it out from one visit. Ask your app developers, listen for customers who report a payment error followed by a second payment page, and test the Checkout button as one check among several.

1. **Read your email.** Logbase says it has contacted all affected merchants and Swym says it is contacting all impacted stores directly.
2. **Ask customers what they saw.** A payment step on an address that isn’t your store’s or Shopify’s checkout, or a payment error followed by a normal checkout, matches what the developers and the Community merchant reported.
3. **Test the Checkout button.** The independent analysis suggests a fresh private window: add any item to the cart, press **Checkout** and check that you land on the real checkout. Qikify’s notice on the July incident also advises testing the Checkout button to confirm it goes to your normal Shopify checkout. Watch the address bar on the payment step. In our reading, a clean result does not clear a store: the analysed script ran once per session, and Logbase says its redirect did not succeed on every visit.

Swym names checkout-guard[.]top as the domain its investigation found, and account-confirm[.]top, billing-confirm[.]top and checkout-secure[.]top as seen in similar attacks. The independent analysis found biliing[.]top, checkout-confirm[.]top and order-confirm[.]top in the script’s configuration. The two lists share no domain, so treat them as examples, not a complete list.

## How do I check my apps and theme for injected code? {#how-do-i-check-my-apps-and-theme-for-injected-code}

Check three places in your Shopify admin: your live theme’s App embeds in every market, each installed app’s access and extensions, and your theme code.

### App embeds, in each market {#app-embeds-in-each-market}

Shopify says app embeds can “add code to your online store without being visible to your customers” ([Shopify: apps in themes](https://help.shopify.com/en/manual/online-store/themes/customizing-themes/apps)).

1. From your Shopify admin, go to **Online Store**.
2. Find your live theme and click **Edit theme**.
3. If you sell in more than one market, pick one from the **Market** drop-down menu: embeds can differ by market, and if you don’t select one, changes apply to the Store default.
4. On the sidebar, click the **App embeds** icon.
5. For an embed you don’t recognise or no longer use, click its toggle to turn it off, then click **Save**.
6. Repeat steps 3 to 5 for each market.

> **Note:** The steps above don’t reach a theme edited in Canvas, Shopify’s new store editor: you can’t add or configure app embeds in Canvas, and a theme edited there can’t be opened in the theme editor, according to [Shopify’s help](https://help.shopify.com/en/manual/online-store/themes/canvas/requirements) (checked 21 October 2026).

### Installed apps {#installed-apps}

1. Go to **Settings** → **Apps** and click an app.
2. Under **Activity and permissions**, see which areas of your store the app can view or edit and the date of its last activity in each; access it hasn’t used in the last 30 days is listed under **Unused access** ([Shopify: managing apps](https://help.shopify.com/en/manual/apps/managing-apps)).
3. On the **Extensions** card, see how many extensions are active and where, such as **Online Store** or **Checkout**.
4. To remove an app, go back to **Settings** → **Apps**, click the menu icon beside it, choose **Uninstall**, then click **Uninstall** again.

Before you uninstall, check the app’s listing or ask its developer about extra steps: Shopify says some apps leave theme code behind that isn’t removed automatically ([Shopify: uninstalling apps](https://help.shopify.com/en/manual/apps/uninstalling-apps)). A delisted app is not an uninstalled one: Shopify defines delisting as removing an app from the App Store and blocking new installs, so stores that already have it keep it ([Shopify: removal actions](https://help.shopify.com/en/partners/help-support/faq/removal#actions-taken-for-violations)).

### Theme code {#theme-code}

Shopify notes that some apps inject code directly into a theme’s code, and Swym’s 20 October FAQ asks merchants to “search all theme files for checkout-guard (the malicious domain)” and to look for theme file edits shown as made by the Swym app.

1. From your Shopify admin, go to **Online Store**.
2. Click the horizontal menu icon beside your theme, then **Edit code**. Shopify recommends duplicating the theme first as a backup.
3. Click the search icon to open the search panel.
4. In the **Search** field, enter each name without the brackets or the ending, one at a time: `checkout-guard`, `checkout-secure`, `checkout-confirm`, `order-confirm`, `account-confirm`, `billing-confirm` and `biliing`. Results list every match and the file it is in ([Shopify: editing theme code](https://help.shopify.com/en/manual/online-store/themes/customizing-themes/edit-code/edit-theme-code)). In our reading, a match is a lead to inspect, not proof: `checkout-confirm` or `order-confirm` can also match ordinary names.
5. To undo a change to a file, open the file’s **Timeline** view, right-click an earlier entry, choose **Restore contents**, then **Restore**. It restores one file at a time and its history is finite, so older versions may be gone. Files in the **assets** folder, such as JavaScript, have no Timeline history.

An empty search does not clear a store. In our reading, it covers only theme files, while the independent analysis traced the Hulk code to HulkApps’ servers and Qikify says its July incident touched only app settings, not themes.

## What should I do if my store was affected? {#what-should-i-do-if-my-store-was-affected}

Switch off the app’s embed or uninstall the app, contact its developer, and decide with your advisers what to tell customers.

1. **Remove the code you can find.** Turn off the app’s embed, search the theme as above, or uninstall the app after checking its leftover-code steps.
2. **Consider private mode.** In private mode every storefront page is hidden behind a password page ([Shopify: password page](https://help.shopify.com/en/manual/online-store/themes/password-page)). Go to **Online Store**, click **Public**, select **Private**, optionally change the **Password**, and click **Update**. While it is on, customers cannot reach your store, and iTnews reports Shopify asking one store to do it; no source says Shopify has asked other stores.
3. **Contact the developer.** Shopify supports only its own apps and sends merchants to a third-party app’s developer directly ([Shopify: getting support for apps](https://help.shopify.com/en/manual/apps/getting-support)). From **Settings** → **Apps**, click the app’s menu icon, then **Get support**. If it’s missing, find the developer’s contact details on the app’s App Store listing.
4. **Work out your duties to customers.** Swym tells merchants they may have their own obligations to notify shoppers or regulators, for example under breach-notification or data-protection laws, and to check them with their advisers. Ask a lawyer which apply in the countries you sell to.
5. **Secure your accounts.** Swym says that, from its investigation so far, the activity used its app’s access, not merchants’ staff accounts, and still recommends two-factor authentication. Shopify’s [two-step authentication](https://help.shopify.com/en/manual/your-account/logging-in/secure-sign-in) page covers turning it on.

## How do I lower the risk from apps? {#how-do-i-lower-the-risk-from-apps}

Install fewer apps, uninstall the ones you don’t use, and repeat the App embeds check after you add or update one. What Shopify has said since 10 October, with dates:

- **To the press, 17 October.** A Shopify spokesperson told iTnews: “When an app falls short, we act.” The actions include delisting an app and asking its developer to tell affected merchants.
- **To developers, 20 October.** In [Securing your app, together](https://shopify.dev/changelog/blog/securing-your-app-together), Shopify asks every app developer to act on a list of steps that week, without naming any incident, including two-step authentication on developers’ accounts. Shopify says it is tightening the boundaries for storefront app code and raising App Store security requirements, with details and timelines before any change takes effect.

Run the checks above before any sale-season code freeze; [the Shopify changes since Black Friday 2025](/blog/shopify-changes-before-black-friday/) lists what else to check.

> **Note:** How we made this guide: researched and drafted with AI tools, and every fact checked against the linked sources on 21 October 2026. Spotted an error? Email [support@b2bgold.app](mailto:support@b2bgold.app).

## Related reading {#related-heading}

- 24 September 2026 **[Should You Block VPN Traffic on Your Shopify Store?](/blog/block-vpn-shopify/)** Blocking VPNs stops some fraud and some honest shoppers. How Shopify treats VPNs, what iCloud Private Relay changes, and a narrower option: scraper networks.
- 24 September 2026 **[How to Block a Customer on Shopify](/blog/block-customer-shopify/)** Shopify has no block button. Stop a problem customer with Fraud Control rules, Shopify Flow, account settings and IP blocks, and see which they can get around.
- 24 September 2026 **[How to Block an IP Address on Shopify](/blog/block-ip-address-shopify/)** Block an IP from checking out or from browsing your Shopify store. Where to find a visitor's IP, Fraud Control rules vs blocker apps, and why IP blocks fail.