Shopify
Shopify App Hacks October 2026: How Fake Checkout Attacks Worked and How to Protect Your Store
October 2026 has been a rough month for Shopify merchants. Several popular apps were used to send shoppers to fake checkout pages, Shopify disabled or delisted a long list of apps, and plenty of store owners woke up to emails asking whether their store was affected. If you sell on Shopify, especially in the run up to Black Friday, this is worth ten minutes of your time.
The good news is that the attacks did not come from Shopify’s own checkout being hacked, and most merchants’ theme code was clean. The bad news is that the malicious code was hidden in a place most people never look: app settings that load from the app vendor’s servers.
What actually happened
Here is the timeline of confirmed incidents, based on vendor statements and Shopify updates:
- Hulk Product Options (October 10): An unauthorized configuration change redirected some checkouts to a fake page. The extension has since been restored.
- Selleasy (October 13): An attacker used an internal Selleasy tool to add a phishing script to some stores. Selleasy says the app is safe, but it is currently not listed on the App Store.
- Swym Wishlist Plus (October 14 and 18): An unauthorized change loaded a script on some stores. After further injection attempts, Swym disabled the app for all merchants and is restoring access in phases.
- Boost AI Search & Filter (October 17): Shopify disabled it over a security issue. It still runs on existing stores but cannot be installed fresh.
- Consentmo and Privy: Both were removed from the App Store without a public explanation.
Separately, an independent tracker counted 482 apps delisted between October 15 and 23, with 41 restored. Most of those are probably unrelated to the attacks, but the list includes names many growing stores rely on, such as Rebuy, ReConvert, Aftersell, Upcart, 17TRACK, Track123, several Bold apps, SEOLab and Brevo PushOwl.
How the fake checkout attack worked
Most Shopify apps add features to your storefront through app embeds. The app’s code is loaded from the vendor’s servers every time a page loads, and many apps let merchants or the vendor add custom JavaScript or HTML in the app settings.
The attackers got into that configuration layer, not into your theme. They added a script that, under certain conditions, sent a shopper who clicked checkout to a page that looked like a real checkout. Shoppers who typed in card details were at risk. Shoppers who paid with wallets like Shop Pay or PayPal were mostly spared, because those flows leave the page before card details are typed.
Three details made it hard to spot:
- It did not show up in theme code. Searching your theme files would find nothing.
- It did not fire every time. One test checkout could look perfectly normal.
- Some browsers blocked it. A merchant testing in one browser could miss what a customer saw in another.
What Shopify has changed
On October 20, Shopify added protection against unexpected redirects from the storefront. After an update on October 23, the storefront now blocks links to sites Shopify identifies as malicious and asks shoppers to confirm before visiting sites it considers suspicious.
That is a real improvement, but it is a safety net. It does not replace knowing what apps are running on your store and what they are allowed to do.
A 6 step security check for your Shopify store
1. Test checkout properly
Open a private or incognito window and go through checkout several times, on desktop and on your phone. Try Chrome and Safari. Make sure the address bar stays on your domain or on Shopify’s checkout domain the whole time.
2. List every app and app embed
In your admin, go to Online Store, Themes, Customize, App embeds and write down everything that is switched on. Then compare it with Settings, Apps and sales channels. Uninstall anything you no longer use. Every idle app is extra risk with no benefit.
3. Check app settings for custom code fields
Open each app’s settings and look for boxes labelled custom JavaScript, custom HTML, tracking code or advanced scripts. If there is code there you did not add, take a screenshot, remove it and contact the vendor.
4. Turn on two factor authentication everywhere
Require 2FA for every staff account, and switch it on for every app dashboard that offers it. A stolen app login is just as dangerous as a stolen Shopify login.
5. Plan a fallback for critical apps
If an app runs your cart drawer, upsells, pricing or order tracking, ask yourself what happens if it is switched off tomorrow. With BFCM close, having a simple fallback (even a native Shopify feature with fewer bells and whistles) beats a broken cart on your busiest day.
6. If you saw redirects, act fast
Contact Shopify Support, switch off the suspected app embed and keep evidence. Speak to your payment provider and check your legal notification duties, since card data may have been entered on a fake page.
What this means for stores in the US, UK and Australia
United States: Card fraud complaints and chargebacks are often the first sign something went wrong. Watch dispute rates in Shopify Payments over the next few weeks, and check state breach notification rules if you confirm card details were captured.
United Kingdom: If shoppers’ personal data or card details were collected by attackers, UK GDPR may require you to notify the ICO within 72 hours of becoming aware. UK customers are used to strong payment security from 3D Secure, so a fake page can be convincing.
Australia: The Notifiable Data Breaches scheme applies to many online retailers. If a breach is likely to cause serious harm, the OAIC and affected customers may need to be told. Australian shoppers also use wallets heavily, which helped limit exposure.
Should you stop using third party apps?
No. Apps are a big part of why Shopify works so well. But this month is a reminder to run a leaner stack. Many stores we audit have ten or more apps doing jobs Shopify now does natively, from bundles to basic upsells and policies. Fewer apps means fewer vendors who can push code onto your storefront, faster pages and fewer monthly bills.
Where you need something custom, a small private app or a theme level feature built for your store often costs less over a year than stacking subscriptions. If you want help deciding, our guide to Shopify conversion rate optimization shows which features actually move sales.
Sources
Need a hand with this on your own site? See our Shopify development services.
Frequently asked questions
Was Shopify itself hacked?
Based on what is public, no. The confirmed incidents involved third party app configurations that loaded scripts on storefronts. Shopify’s own checkout was not reported as compromised.
How do I know if my store was affected?
Check whether you use any of the named apps, test checkout several times in private windows, and review app settings for code you did not add. If you are unsure, contact the app vendor and Shopify Support.
Are Shop Pay and PayPal customers safe?
They were mostly spared, because wallet payments do not ask shoppers to type card numbers on the page that was hijacked.
Can Web Brick Studio audit my Shopify apps?
Yes. We review your apps and embeds, remove what you do not need and replace risky features with native or custom solutions. Contact us before Black Friday.
