Shopify App Security Checklist (October 2026)

Since 10 October 2026, several Shopify apps have been used to redirect shoppers to fake checkout pages that collect card details. Shopify’s own checkout wasn’t breached. The malicious code was delivered through the apps’ own settings and ran on the storefront.

Because the same technique and phishing domains appear across unrelated developers, it’s being treated as a coordinated campaign. Many other apps have been delisted from the App Store in the same period, some without any public explanation.

Confirmed vs. unconfirmed

Confirmed incidents:

• Hulk Product Options (HulkApps)
• Selleasy
• Swym Wishlist Plus

Delisted, no confirmed incident (at time of writing):

• Boost AI Search & Filter
• Consentmo GDPR Compliance
• Rebuy
• Privy
• 17TRACK

A delisting on its own doesn’t mean an app was compromised. Treat it as a reason to check, not as proof of a problem. See the full list of delisted apps.

The checklist

1. Test your checkout, three times

Open a fresh private browser window, add a product and click Checkout. You should land on your own domain or a Shopify domain. Repeat in two more new private windows. The attack only fires once per visitor, so a single clean test doesn’t prove much.

2. Test every route to checkout

Try the cart drawer, the cart page, any sticky add-to-cart bar and any express checkout buttons. In the Swym case, the script also reacted to hovering over a button, not only to clicks.

3. Know what a bad redirect looks like

These are the phishing domains reported so far:

• account-confirm[.]top
• billing-confirm[.]top
• checkout-confirm[.]top
• order-confirm[.]top
• biliing[.]top
• checkout-guard[.]top (unconfirmed)

If checkout ever takes you to a domain other than yours or Shopify’s, go straight to If your checkout redirects somewhere else below.

4. List every app that touches your storefront

Go to Settings → Apps and sales channels. Note every app customers can see or interact with: wishlists, search and filters, upsells, cookie banners, popups, product options and reviews.

5. Turn off confirmed apps

If you run Hulk Product Options, Selleasy or Swym Wishlist Plus, turn them off until the developer and Shopify confirm the issue is fixed. In the theme editor, open App embeds. A single app can have more than one embed, and they’re not always clearly labelled. Swym, for example, has at least two.

6. Check apps’ “custom JS” or “custom code” fields

This is how the attack got in: apps that let you store raw JavaScript in their settings and then run it on your storefront. Open the settings of every storefront app and look for code you can’t account for.

7. Clear cached app data in your own browser

Disabling an app doesn’t always stop the code. In the Swym case, it was cached in the browser’s local storage and stayed after the app was turned off. Clear your browser’s site data for your store, then test again.

8. Check delisted apps with the vendor

For every app marked “not currently available”, ask the developer in writing:

• Why was the app delisted?
• Was my store affected?
• If so, for how long?
• Does the fix clear cached settings in shoppers’ browsers, or only the live script?

9. Repeat the checkout test daily

Do it every day until the developers and Shopify confirm the issue is resolved.

Managing multiple stores?

Dylan Pierce has published an open-source tool that runs checkout tests in fresh browser sessions and flags apps sending custom JavaScript to the page. His write-up explains how the hijack works.

If your checkout redirects somewhere else

1. Enable your store password immediately.
2. Turn off the app’s embeds in the theme editor, and remove its scripts from theme code if needed.
3. Clear your browser’s site data and test again in fresh private windows until checkout stays on your domain.
4. Report the domain to Shopify Support.
5. Turn on 2FA for your Shopify account and the app’s own account, and change that app account’s password.

What not to do

• Don’t assume the first explanation is right. In one case, Hulk was blamed first, but removing it changed nothing. The source was Swym. Test after every change.
• Don’t bulk-uninstall apps. Uninstalling doesn’t always remove what an app added to your theme or to shoppers’ browsers.
• Don’t remove your cookie consent app without a replacement. Losing consent management can cause compliance problems of its own.
• Don’t wait for an email. Merchants haven’t always been notified when an app was affected or switched off.

For app developers

On 15 October, Shopify added a security check to the Shopify CLI and AI Toolkit. It scans app code for the mistakes behind this attack, such as unsafe innerHTML, settings that can carry markup and open redirects. Add it to your CI pipeline. See Shopify’s app security check.

Frequently asked questions

Was Shopify’s checkout hacked?

No. Shopify’s checkout wasn’t compromised. The malicious code came through third-party apps running on the storefront.

My app is delisted. Do I need to remove it?

Not necessarily. Delisting blocks new installs, but existing installs often keep running. Test your checkout and contact the developer first.

I disabled the app. Am I safe?

Not always. In the Swym case, the code was cached in shoppers’ browsers and stayed after the app was disabled. Keep testing, and ask the developer whether cached settings are being cleared.

I tested once and it was fine. Am I safe?

Not necessarily. The attack only fires once per visitor. Test three times, each in a new private window.

Sources

• Roman Zipp’s running investigation, the most complete public timeline
• Dan S. on LinkedIn, who traced the Swym case
• Swym’s official security response

While you’re checking your store

If you’re testing your checkout this week anyway, it’s worth looking at the rest of the path to purchase too.

Q4 brings more traffic than any other time of year, and small issues cost more when volume is high: a slow collection page, an upsell that clutters the cart, or an app that has quietly stopped working. Most of these don’t show up until you’re losing sales.

Two ways we can help