Shopify Checkout Hijack (October 2026): How Stores Got Hit and How to Defend Yours

Starting October 10, 2026, security researchers documented a checkout hijack wave hitting Shopify stores. Shopify’s own platform was not breached — instead, attackers compromised popular third-party apps (HulkApps, Swym Wishlist Plus, Selleasy) and turned them into payment-skimming funnels. If you run a Shopify store, here’s exactly what happened and the five defenses you should set up this week.

How the October 2026 Checkout Hijack Worked

The attack chain was a classic supply-chain compromise at the app layer:

1. Legitimate Shopify apps inject a storefront script — served from cdn.shopify.com, so it looks completely legitimate.
2. That script fetches its configuration from the vendor’s own API on every page load, treating the config as trusted input.
3. Attackers got write access to that configuration and pushed roughly 22KB of unobfuscated JavaScript into every store running the app.
4. The script attached a click listener — literally named hijack in the code — at the window/document level.
5. When a shopper clicked the checkout button, they were redirected once per browser session to a fake payment page on a lookalike domain (biliing[.]top).
6. The fake page captured card details, then quietly forwarded the shopper to the real Shopify checkout.

The order completed normally. The customer got their product. The merchant’s dashboard showed nothing unusual. Most store owners had no idea anything happened.

Why Merchants Couldn’t Catch It Manually

• One redirect per session: if you tested your own checkout, you saw a clean page. New visitors got hit; you didn’t. The payload used a session-storage flag so each browser was redirected only once.
• Trusted CDN delivery: the malicious code arrived through an app script served from Shopify’s own CDN. URL inspection reveals nothing suspicious.
• No order anomalies: the actual card theft happened on the fake page, entirely outside your store’s payment flow.

One developer only found it because his checkout redirected to a strange domain — he traced it with Chrome DevTools event-listener breakpoints and found a function named hijack inside hulkcode.js, a script authored by the app vendor.

5 Defenses Every Shopify Store Should Set Up This Week

1. Update or remove the affected apps immediately

Swym shipped a fix (v7.0.18) on October 14. If you run HulkApps product options, Swym Wishlist Plus, or Selleasy — update right now, or remove them if you don’t actively use them.

2. Run the incognito checkout test — properly

Fresh private window, ideally a different device, click through to checkout and watch the URL. Remember the catch: the redirect fires once per session, so a single test can miss it. Test from multiple browsers and devices.

3. Audit every app with a “Custom JavaScript/HTML” field

That vendor-dashboard config field was the exact attack surface in this incident. Go through Settings → Apps and sales channels. Anything with custom-code injection capability that you don’t actively need should go.

4. Watch outbound requests during checkout

Open Chrome DevTools → Network tab, complete a full checkout, and review the hostnames. Any domain that looks like Shopify but isn’t — lookalike spellings, sketchy TLDs like .top, .xyz, .icu — needs investigation the same day.

5. Rotate credentials for your app vendor dashboards

A compromised merchant account on the vendor side is one documented entry point for this attack class. Rotate passwords, enable passkeys or 2FA on every third-party app dashboard you can log into.

The Part Nobody Tells You: Manual Checks Don’t Scale

Every defense above is a manual, point-in-time check. The October hijack fired once per session — your spot-check passes while real customers get hit. Nobody diffs network traffic weekly. Nobody retests from three devices every morning.

That’s exactly the gap ThemeSafe – Security Review was built to close. Its new Checkout Shield feature continuously watches the app scripts running on your storefront and alerts you the moment anything attempts to hijack or redirect your checkout — the same pattern as this October wave. Set it up once; it keeps watching while you sleep.

Keep your checkout yours. The October 2026 hijack won’t be the last — the playbook is proven now: one compromised app pushes a payload to every store that installed it. Attack effort scales once; damage scales across the entire install base.

Quick FAQ

Was Shopify itself hacked?
No. There is no public evidence that Shopify’s platform, servers, or payment systems were breached. The attack went through compromised third-party storefront apps.

Was my store affected?
If you installed HulkApps product options, Swym Wishlist Plus, or Selleasy during the affected window and a customer clicked checkout as a “fresh” session, their card details may have been captured on a fake page. Update the apps and review recent chargebacks and customer complaints.

How do I check my store for checkout hijacking right now?
Run the incognito test from step 2 above, check your installed apps for custom-code fields, and consider an automated scanner like ThemeSafe – Security Review that watches checkout integrity continuously.