Shopify Checkout Hijack October 2026: What Happened and How to Protect Your Store

If you run a Shopify store, October 2026 was a wake-up call. Security researchers documented a checkout hijack wave that redirected real shoppers to fake payment pages – and the scariest part is that no theme file was ever touched. Store owners who ran theme scans all week got a clean bill of health while their customers’ card details leaked.

Here’s the full breakdown of what happened, why it worked, and the exact checklist to protect your store.

What Happened in October 2026?

Shopify’s core platform was not breached. Instead, attackers compromised third-party storefront apps – including HulkApps Product Options, Swym Wishlist Plus, and Selleasy – and used them as delivery vehicles for malicious code.

These apps inject scripts into your storefront, served from Shopify’s own CDN. That’s what made the attack so insidious: the malicious code looked completely legitimate because it rode on trusted infrastructure.

How the Checkout Hijack Actually Worked

The attack chain was genuinely clever, and understanding it is your best defense:

1. Compromised app config. The affected apps fetched JavaScript configuration from the vendor’s own API on every page load. Attackers got write access to that configuration.
2. ~22KB of injected JavaScript. The payload shipped to every store running the compromised app – unobfuscated, with a click listener literally named “hijack” in the code.
3. One redirect per session. When a shopper clicked the checkout button, they were redirected to a fake payment page on a lookalike domain – biliing[.]top, one letter off “billing”. The fake page captured their card details, then forwarded them to the real Shopify checkout.
4. The order completed normally. The customer got their product. The merchant saw nothing unusual in their dashboard. The fraud happened entirely outside the store’s payment flow.

Domains like biliing[.]top, checkout-confirm[.]top and friends were listed by Spamhaus by October 15 – but by then the wave had already done its damage.

Why Theme Scans Missed It Completely

This is the part every store owner needs to internalize: the attack never touched your theme.

Popular security advice says “scan your theme code for suspicious changes.” Good advice – for a different attack. This wave lived in the app layer: app embeds, app scripts, and vendor-side configurations that theme scanners don’t watch.

Three properties made it nearly invisible:

• The redirect fired only once per browser session – if you tested checkout yourself, you saw a clean page. New visitors got hit; you didn’t.
• The code came through a trusted app script on Shopify’s CDN – URL inspection shows nothing suspicious.
• No order anomalies – orders completed, fulfillment ran normally.

Your 5-Step Defense Checklist

1. Audit every app with a Custom JavaScript field

That config field was the exact attack surface here. If an app has a “Custom JavaScript/HTML” setting and you don’t actively need it – remove the app. Update or uninstall the affected apps immediately if you still run them (Swym shipped a fix in v7.0.18).

2. Run the incognito checkout test – properly

Fresh private window, ideally a different device. Add to cart, click checkout, and watch the URL. Real Shopify checkout always lives at /checkouts/. The fake pages used paths like /check-out/ – one hyphen off. Remember: one redirect per session means a single test can miss it, so repeat across sessions.

3. Watch outbound requests during checkout

Open Chrome DevTools → Network tab while checking out. Any domain that looks like Shopify but isn’t – lookalike spellings, .top/.xyz/.icu TLDs – needs investigation the same day.

4. Rotate your app vendor dashboard credentials

A compromised merchant account on the vendor side is a documented entry point for this attack class. Rotate passwords and enable 2FA on every app dashboard you use.

5. Get continuous monitoring on the app layer

Manual checks don’t scale. You can’t diff network traffic weekly or catch once-per-session redirects by hand. That’s the gap ThemeSafe – Security Review was built to close: its Checkout Shield feature continuously watches what actually runs at checkout, detects rewrites to non-Shopify destinations, and blocks redirects to known fake payment pages outright – while legitimate checkouts pass untouched. When it catches something, it tells you exactly which app embed caused it, so you can kill it in one click.

The Uncomfortable Truth About App Supply Chain Attacks

The October hijack won’t be the last. The playbook is proven now: compromise one app, push a payload to every store that installed it. Attack effort scales once; damage scales across the entire install base.

Store owners who treat app security like theme security will keep getting surprised. The app layer is where the next wave is coming from – watch it continuously, or use a tool that does.

Run a Shopify store and want a sanity check on your app setup? Drop a question in the comments – happy to point out the risky bits.