The news
From 10 October 2026, attackers changed the settings of at least three apps from the Shopify App Store so that some stores sent shoppers to fake checkout pages. The pages looked like Shopify's checkout and asked for card details. Developer Roman Zipp, who uncovered the HulkApps case, found that the fake page then passed shoppers on to the real checkout, where they could still place their order.
Three app makers have confirmed incidents. HulkApps said an exploit added unauthorized settings to Hulk Product Options. Logbase said someone got into an internal tool for its upsell app Selleasy and added a script to the settings of some stores on 13 October, between 07:47 and 15:00 UTC. It says more than 49,000 stores use the app. Swym said an unauthorized change to Wishlist Plus loaded a script on some storefronts on 14 October, and that the script has since been removed from all storefronts.
None of the developers says Shopify's own checkout was breached, and no one has said how many stores or shoppers were affected. Shopify told the Australian news site iTnews on 17 October that it acts when an app falls short, which can include removing it from the App Store, and that merchants can review the activity and permissions of any app at any time.
On 20 October, Shopify asked all app developers to act that week: run its security check, move to expiring access tokens and turn on two-step authentication for their accounts.
What it means for you
- An app you installed months ago can change what shoppers see on your store without any edit from you.
- Shoppers who typed a card number into a fake page may face fraud, and you may have to tell them, your payment provider or a regulator.
- Shoppers were passed on to the real checkout afterwards, so orders could still arrive and sales figures alone might not show a problem.
What to do now
- In your Shopify admin, open the list of installed apps and remove the ones you no longer use.
- In the theme editor, open App embeds and turn off any embed you do not recognize.
- Open your store in a private browser window, add a product and go to checkout, then check that the payment page opens on your store's own address.
- If a shopper reports a strange payment page, note the address and the time and contact Shopify Support and the app's developer.
How Didset can help
We build custom Shopify apps that you own and control, for features such as wishlists, product options and upsells.
Talk to us about it
