Three Shopify Apps Hijacked to Fake Checkouts: Test Yours

Three Shopify apps were hijacked between October 10 and October 14 and used to redirect shoppers from the checkout button to fake card-harvesting pages.

According to developer Roman Zipp, who traced the first redirect, and to statements from the app companies, the injected script sent shoppers to lookalike payment pages such as biliing[.]top before dropping them into the real checkout. For the high-ticket store owners I teach at Ecommerce Paradise, the lesson is blunt: your checkout button can be turned against you by a wishlist or upsell app, and Shopify’s own checkout never has to be breached for it to happen.

Below: what Hulk Product Options, Selleasy and Swym Wishlist Plus say happened, the earlier incidents that set the pattern, what a hit could cost a store selling $2,000 items (hypothetical math, labeled), and a six-step checklist you can finish this week. I covered a related third-party risk in my breakdown of fake Claude ads routed through a hacked retailer’s site.

One hijacked app can put your store in front of angry customers, card issuers and lawyers, so form your LLC the right way with Northwest, the best LLC formation service for ecommerce owners. Northwest forwards physical mail to operators who live outside the formation state or country, so a store owner on the road still gets the legal notice that follows an incident like this. Form your LLC with Northwest →

Hulk, Selleasy and Swym Apps Redirected Shopify Checkouts

The first public report landed on October 10. Zipp, shopping from Germany, wrote on his blog that the checkout button on mechanicalkeyboards.com sent him to biliing[.]top/check-out/. Using browser developer tools he traced the redirect to a file named hulkcode.js, attributed to the Hulk Product Options app from HulkApps.

According to Zipp, that file pulls a custom JavaScript block of roughly 22.7 KB from HulkApps’ servers on page load and runs it in the shopper’s browser. The script fires once per shopper and shop, then sets a sessionStorage flag so the redirect does not repeat. He submitted fake card data to the phishing page as a test, and it returned a success response and a record ID before sending him on to the real checkout.

HulkApps said unauthorized configuration changes affected its Product Options extension, and that its security team removed them. Shopify temporarily disabled the extension, then restored it, according to HulkApps’ statement as compiled by Zipp. HulkApps has brought in an independent firm for incident response and a penetration test.

Selleasy followed on October 13. Logbase, the developer behind the upsell app, said an unauthorised party accessed an internal tool and added a malicious script to the Selleasy settings of a number of stores between 07:47 and 15:00 UTC, according to iTnews. That is a window of 7 hours and 13 minutes. Logbase claims more than 49,000 active stores use Selleasy and has not said how many were hit.

Swym Wishlist Plus came next. Swym told merchants an unauthorized change to the app’s configuration, made through an access channel it has since secured, loaded a script on certain pages of a limited subset of storefronts between 10:06 and 16:32 UTC on October 14, per the statements gathered on Zipp’s blog. Swym says it does not handle card data and found no access to merchant or Swym data. Its investigation is ongoing.

The human cost showed up in Australia. Carly Clarke, owner of dog harness retailer WAGD, learned of the redirect when a customer sent her a screenshot. She closed the store and reported it to Shopify, which advised her to keep it password-protected while it investigated, even after the app developer and Shopify confirmed the code was gone, per iTnews. Clarke had received no reopening date and had not calculated her losses. iTnews updated its report on October 19 to say Shopify had told her she could reopen.

On October 17 a Shopify spokesperson told iTnews that all App Store apps must meet strict security and privacy standards and that Shopify acts when apps fall short, including delisting them. As of October 16, Tech Business News reported that Selleasy, Hulk Product Options and Swym Wishlist Plus all showed as unavailable on the Shopify App Store. Zipp’s update notes also flag a fourth app, Privy, on an unconfirmed commenter report dated October 17. I found no statement from Privy.

Qikify and Hextom Were Hit First, in July and August

This is not the first time vendor-side settings became the weak point. Per Zipp’s timeline, Qikify had a similar incident in July that was fully resolved by August, and he marks a Hextom incident in August as resolved. Qikify says it is not part of this week’s wave.

Qikify told Zipp it believes a compromised credential, likely leaked from outside its own systems, let someone place malicious code in two customizable HTML fields in its app settings rather than in merchant themes. Its view is that AI coding assistants and agents with excessive permissions may be raising credential exposure. That is Qikify’s opinion, and the compilation I reviewed does not show evidence for it.

The common thread is the place the code lived. In the Hulk case it arrived through a custom JavaScript setting served from the vendor’s API. In the Selleasy case it was a script added to store settings through an internal tool. Your theme files can be spotless and still run an attacker’s code, because the app loads instructions from its vendor every time a page opens.

There is a counterpoint, and it matters. Logbase told iTnews the redirect did not work on every visit and some browsers blocked it, and it could not rule out that shoppers entered details on the fake page. Flagship, a Japanese commerce agency, wrote on October 16 that none of the reports point to a fault in Shopify’s own checkout, and that it had not established whether the incidents share one cause. The companies also say their apps are safe to use today. Selleasy has said so, with a forensic audit and detailed report still pending.

Open questions remain. Zipp says how the malicious code entered HulkApps’ configuration is still unclear, and nobody has published how many shops were affected. If you want the wider picture on how store-adjacent platforms leak, my write-up on the ASOS breach through customer messaging platforms shows the same shape. So does the Ninja Forms flaw that planted hidden admins.

What a Checkout Hijack Costs a High-Ticket Shopify Store

My read: the headline risk is not the card numbers. It is the downtime and the paper trail that follow. WAGD closed on October 13 and, per iTnews, was not cleared to reopen until October 19, and its owner could not put a number on the damage.

Here is hypothetical math, not a reported figure. Say a store sells at a $2,000 average order and lands 5 orders a day. That is $10,000 a day. Six days behind a password page is $60,000 of delayed or lost sales, before any refund, support or legal cost. A store doing 1 order a day loses $12,000 over the same stretch. Neither number includes a single stolen card.

High-ticket buyers are also the shoppers a card harvester wants most, because large purchases tend to sit on high-limit cards. That is opinion, not a finding from any report. It is the reason I would treat a checkout redirect on a $3,000 product page as a bigger incident than the same redirect on a $20 impulse buy.

Notification is the murky part. Swym’s guidance to merchants, as compiled by Zipp, says to consider notifying shoppers who typed card numbers into checkout during the affected window and to check duties under applicable laws, GDPR or your payment processor agreement. I am not a lawyer, so take that list to one. If you do not have an attorney on call, a plan like LegalShield is one way to get access without a retainer.

Payment-card rules matter here too. The PCI Security Standards Council published an information supplement on March 10, 2025 covering requirements 6.4.3 and 11.6.1, which deal with authorizing and monitoring scripts on payment pages, per the PCI Council blog. The Council says it does not enforce compliance and tells merchants to work with their acquirers on validation. Whether a script on your cart page falls inside that scope is a question for your processor. My view is to treat any script that can touch the checkout button as in scope.

Shopify’s new shopify app security check command, which arrived October 15 per Flagship’s reading of the developer changelog, scans apps for vulnerabilities before submission. It is a developer tool, not something you run as a merchant. You can see why Shopify points merchants at reviewing each app’s activity and permissions instead.

The stack I would defend is a short one. Every app is a vendor with a key to your storefront, so the app list should be as short as your margins allow. I walked through the same logic in my guide to protecting a high-ticket store as it scales. My breakdown of dropshipping tools by job is the place to shortlist replacements for anything you cut.

Some tools earn their place in an incident. A support desk such as Gorgias lets you tag every “weird payment page” complaint so the pattern shows up in hours, not weeks. An email platform like Klaviyo lets you contact only the customers who ordered inside an exposure window.

The chargeback side is real. Visa widens its chargeback evidence rules from October 24, and I laid out what that means in my post on Visa’s chargeback evidence changes. Keep screenshots, order timestamps and vendor emails now, because those are the documents a dispute needs later. Fraud screening from ClearSale is worth pricing if your chargeback rate is already creeping.

If a processor or platform freezes you while this is investigated, one account is a single point of failure. I covered the backup plan in my guide to payment processor backups. A multi-currency account such as Airwallex is one option for a second rail.

The cleanest defense is not owning the problem in the first place. A store launched with five apps instead of twenty-five has fewer vendors who can hijack a checkout. That discipline is how I’d build a store from day one, and it is the reason to look at the turnkey done-for-you service if you would rather have my team build and run it.

Every extra app is another vendor who can touch your checkout button. Want my team to build and run a lean high-ticket store for you? See the turnkey done-for-you service →

Shopify Checkout Hijack Checklist: Test Your Store This Week

Here are six checks, in the order I would run them. Most take under an hour.

Inventory every app that injects code. Open your Shopify theme editor, look at the App embeds panel, then open each app’s own settings for custom JavaScript or HTML fields. Flag Hulk Product Options, Selleasy, Swym Wishlist Plus, Qikify, Hextom and Privy if you run them, and remove anything you have not used this quarter.
Test checkout from every entry point, more than once. Use fresh private windows and click Checkout from the product page, cart page, cart drawer and any quick-buy button. The address bar must stay on your domain or your myshopify.com address. Because the Hulk script runs once per session, a clean first test proves little, so repeat it in new windows and screenshot each result.
Pull orders from the exposure windows. If you ran Selleasy, look at October 13 from 07:47 to 15:00 UTC. For Swym, look at October 14 from 10:06 to 16:32 UTC. Flag orders where the card was typed in manually instead of paid through Shop Pay, PayPal, Apple Pay or Google Pay. For Hulk, ask the vendor in writing for your store’s exposure window, because I have not seen one published.
Get a written statement from each vendor. Ask whether your store loaded the script, when, and what changed. Keep the emails with your screenshots, then take the package to your attorney and your payment processor so they can tell you whether notification duties apply.
Lock down accounts. Turn on two-step verification for every staff account and every app vendor dashboard, remove unknown staff, and rotate API tokens. Use Google Workspace to require two-step verification on staff mailboxes, and limit which AI tools and custom apps can reach your admin, which is Qikify’s recommendation as well.
Set a tripwire. Put a monthly checkout test on your calendar, tell your support team to flag any odd payment page report, and book a discovery call if you want a second set of eyes on your app stack. If you are still choosing what to sell, my high-ticket niches list is the place to start.

If you are new to the model, read what high-ticket dropshipping is before you add any more apps. The niche research resource is the lowest-friction next step. Spending a day on this now is cheaper than the six days WAGD lost.

Frequently Asked Questions

Was Shopify’s own checkout hacked?
Not according to the reports reviewed. Flagship states none of them point to a fault in Shopify’s checkout, and the redirects happened on the storefront through third-party app code. Shopify’s spokesperson told iTnews that apps in its store must meet security and privacy standards.

Which apps were involved?
Hulk Product Options (HulkApps), Selleasy (Logbase) and Swym Wishlist Plus (Swym) have all acknowledged incidents. Privy appears on an unconfirmed report. Qikify and Hextom had earlier incidents that Zipp lists as resolved. My Shopify AI-agent readiness audit is a reminder that every new integration adds scripts and permissions to review.

How do I know if my store was hit?
Run the checkout tests in step two, check the exposure windows in step three, and ask each vendor for written confirmation. A clean test is not proof of safety, because the script can fire only once per browser session.

Will I get chargebacks?
Disputes are possible if an issuer ties a compromised card to your store, though no report I reviewed quantifies that. Document everything and read my guide to chargeback prevention for high-ticket stores.

Do I have to notify customers?
It depends on your customers’ locations, your processor agreement and the facts, so ask an attorney. Insurance can also respond to incidents like this, and my guide to business insurance for an ecommerce store covers what to ask a carrier. A privacy and incident policy from Termly helps you document what you told shoppers. I am not a lawyer or financial advisor.

Should I uninstall these apps?
The vendors say their apps are safe now, and Shopify restored Hulk’s extension after temporarily disabling it. My view: if an app does not clearly pay for itself, remove it, and for the rest keep the embed off until the vendor publishes its audit. Selleasy’s forensic report was still pending when Zipp compiled its statement.

Is a CRM useful for tracking affected customers?
Yes. Tagging buyers by order window in a CRM such as HubSpot makes any follow-up email fast. My walkthrough of setting up HubSpot for a high-ticket store shows the basic structure.

Want to see which apps other store owners cut after this week, and why? Join the Skool community →

Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day. If you ran one of these apps, run the checkout test tonight. An hour of testing beats a week of orders stuck behind a password page.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.