Shopify App Checkout Hijack: How to Audit Your Store’s Apps

Shopify app security comes down to one question: which third-party code runs on your storefront, and who can change it? In October 2026, vendors and researchers reported that code delivered through a few Shopify apps sent some shoppers from the Checkout button to a lookalike payment page. None of the reports I read describes a breach of Shopify's own checkout, and orders still completed, which is why store dashboards looked normal. You can check your own store in about 30 minutes without changing anything.

This guide gives you that read-only check. If you only need a list of what a store runs, start with our guide to finding which Shopify apps a store is using. Everything below reflects what was public on 6 November 2026, and several of the vendor notices were still being updated when I last read them.

What was reported in October 2026

Shoppers on several Shopify stores who clicked Checkout were sent to a lookalike payment page. It collected card and personal details, then forwarded them to the genuine checkout, so the order still went through. Security firm cside summarised a developer's analysis on 17 October. The accounts below come from the vendors themselves, as compiled by developer Roman Zipp on 19 October, plus Swym's own notice.

• HulkApps (Hulk Product Options), 10 October: says an exploit added unauthorised configurations to the app's theme extension. HulkApps says its team removed the code, that Shopify temporarily disabled the extension and restored it afterwards, and that the app is fully functional and safe to use.
• Selleasy (Logbase), 13 October, 07:47 to 15:00 UTC: describes it as a deliberate, planned cyber attack. It says an unauthorised party reached an internal tool and added a malicious script to some stores' settings, and that the script was removed from all stores by 15:00 UTC. A forensic report was still pending.
• Swym Wishlist Plus, 14 October: says an unauthorised party changed the app's configuration between about 10:06 and 11:56 UTC, which loaded a script on some pages of a limited set of storefronts. Swym says fixes were fully deployed by 16:32 UTC, that it does not collect or store card data, and that it found no evidence its stored merchant data was accessed.

These are vendor statements and third-party analyses, not independent verification. I found no published count of affected stores or shoppers, so this guide does not quote one. Shopify's developer team posted "Securing your app, together" on 20 October. It asks every app developer to scan their apps, move to expiring access tokens and switch on two-step authentication for accounts that touch their app. The post also says Shopify is tightening the boundaries for storefront app code, with no dates yet. A Shopify spokesperson told iTnews: "When an app falls short, we act."

cside reported that, as of 16 October, the App Store listings for all three apps showed as unavailable. That is a reason to ask the vendor for its status in writing, not a verdict on the app. Decide on evidence: what the app does for you, whether you still use it, and what the vendor has told you.

Why a normal test missed it

A normal test missed it because the app's script file stayed clean while its instructions changed. In the HulkApps case, cside reports that the script on Shopify's CDN was unmodified. On each page load it asked the vendor's servers for configuration, and on affected stores that response carried a field of custom JavaScript. The browser then ran it. A file-integrity check on the script would have passed, because the harmful part arrived as data.

Two more details explain why owners saw nothing. The redirect reportedly fired once per browser session, using a flag in the browser's session storage, so a second test in the same browser looked clean. And because the fake page forwarded shoppers to the real checkout, the order completed. At least one Australian store learned of it when a customer reported the odd checkout page, according to iTnews.

Key figures from the public record

• About 10:06 to 11:56 UTC on 14 October 2026: the window in which Swym says its Wishlist Plus configuration was changed, with fixes fully deployed by 16:32 UTC. Source: Swym security notice, 16 October 2026.
• About 22.7 KB of JavaScript: the size of the code reportedly delivered in one configuration field on affected HulkApps stores. Source: cside analysis, 17 October 2026 (a security vendor's report of a developer's findings).
• 1 October 2026 and 1 March 2027: after the first date apps can no longer create or update script tags; on the second, Shopify stops injecting script tags into storefronts. Source: Shopify developer changelog, 24 August 2026.

A read-only store check (about 30 minutes)

A read-only check means you look and record, but you do not delete or edit anything yet. Work through these four steps in order and write down what you see.

1. List every app and every embed

Start with the apps installed in your Shopify admin. Then open your live theme in the theme editor and look at the App embeds panel. Embeds are small pieces of app code switched on for the whole storefront. For each one, write down the app, what it does for you, who installed it and when you last reviewed it. Flag any embed you cannot name, and any embed belonging to an app you believe you uninstalled.

2. Read every custom-code field

Many apps include a "Custom JavaScript" or "Custom HTML" box in their settings. Open each one and read it. Flag anything you did not write, cannot explain, or that looks long and unreadable. Do not delete it yet. In the October cases some of the code lived on the vendor's servers rather than in your admin, so a clean box does not prove a clean store. That is why step 3 matters.

3. Run the private-window checkout test

1. Open a brand-new private or incognito window, so no earlier session storage is carried over.
2. Add a product to the cart and click Checkout. Do this from the product page, the cart page and any cart drawer or "Buy now" button.
3. Check the address bar at each step. It should show your own domain or the checkout address you normally see, never an unfamiliar domain.
4. Close the window and repeat in a fresh private window, on both desktop and a phone. Because the redirect may fire only once per session, one clean pass is not enough.

4. Look for the markers researchers named

cside's write-up treats a session-storage key beginning with __ctf_ as a confirmed sign of the redirect. In Chrome you can check it under Developer Tools, Application, Session Storage. Treat this only as a clue: finding nothing proves nothing, because anyone writing similar code can use a different name. In the Swym case, the same analysis reportedly traced the payload to a wishlist button label, so label and text fields in app settings deserve a look too.

Watch: Shopify Checkout Hijack: Is Your Store Hacked? Get free Checklist

A five-minute walkthrough of the same incident from the Shift Happens • E-Commerce Journey channel. Title and channel were verified through YouTube's metadata; we have not vouched for every claim in the video.

Watch on YouTube: Shopify Checkout Hijack: Is Your Store Hacked? Get free Checklist

Not sure what your apps are really loading? We can walk through your app stack, theme and checkout path with you.

A ten-question yes/no self-check

Answer each question honestly. There is no score, only a colour at the end.

1. Can I name every enabled app embed and say why it is there?
2. Have I read every custom JavaScript and HTML field in my installed apps?
3. Did a fresh private-window checkout stay on the right domain, on desktop and phone, this week?
4. Is two-step authentication on for every staff and collaborator account that can change apps or themes?
5. Have I removed access for people who no longer need it?
6. Can I reach each app vendor's support in writing, and do I know where its incident notices appear?
7. Have I asked each vendor whether its app still uses script tags?
8. Do I keep a dated change log of app installs, removals and setting changes?
9. Have I asked my payment processor which security requirements apply to my checkout set-up?
10. Do I know who switches an app off first, and how?

Green: yes to all ten. Amber: a no to question 4 to 10, which you can fix this month. Red: a no to question 1, 2 or 3, or any redirect you cannot explain. Treat red as open until you have checked each item.

If you find something

If you find an unexplained redirect or code, preserve the evidence before you switch the app off. cside's merchant guidance lists the order that follows.

1. Capture screenshots, a network recording (HAR file) and timestamps.
2. Contact the app vendor in writing and keep every reply.
3. Open a Shopify Support case.
4. Tell your payment processor.
5. Ask your processor and an adviser about any duty to notify customers or card brands. Swym's own notice advises merchants to check their obligations with their advisors.

Keep all communication in writing. One merchant told iTnews that Shopify advised her to keep her store closed while it investigated, even after the vendor said the code was gone. Timelines can depend on Shopify's review.

Card security rules matter here too. The PCI Security Standards Council says requirements 6.4.3 and 11.6.1 aim to make sure payment-page scripts are authorised, checked for integrity and monitored for tampering. It also added a condition for merchants on the simplest self-assessment form (SAQ A): confirm your site is not susceptible to script attacks. The details are in its March 2025 guidance. Which of these applies to you depends on your set-up, so ask your acquirer or processor.

Script tags end on 1 March 2027: what to migrate

Script tags are a Shopify API feature that lets an app load JavaScript on your storefront, and Shopify stops injecting them on 1 March 2027. Since 1 October 2026 apps can no longer create or update them, but existing script tags keep running until the cut-off, according to Shopify's migration guide. The change applies to every API version.

For you as a merchant, the job is to ask each vendor whether its app still relies on script tags and when its replacement ships. Shopify points developers to these replacements:

Shopify's guidance also warns against running the old script tag and its replacement together, because the script then loads twice. Embeds are visible to you in the theme editor and you can switch them off there, which makes them easier to audit than code you cannot see.

Ongoing: a change log and a quarterly review

An app audit is only useful if it repeats. Keep a simple dated log with one row per app. Record what it does, whether its embed is on, which custom-code fields you have read, the last vendor statement you saw and who owns it. Re-run the private-window test after every app install, app update or theme change, and review the whole list each quarter. This is our practice, not a Shopify rule. Dropping apps you no longer use also helps speed, as we cover in our guide to performance-optimised Shopify themes. The wider routine sits alongside a website security and maintenance checklist.

What you can do yourself, and what needs a developer

You can run the private-window test, list embeds, read custom-code fields and switch on two-step authentication today. Reviewing theme and app code, deciding whether a content-security approach is practical for your theme, migrating script tags and monitoring checkout over time usually need a developer. Our ecommerce team works in a set order. We audit the app stack and theme, then separate first-party from third-party code. Next we prioritise removals and replacements, build theme app extensions or web pixels where needed, test checkout on desktop and mobile, and keep a dated app change log.

Want a recurring check so your app list never goes stale?

Reference reading

• Shopify developer post: Securing your app, together
• Shopify guide to the storefront script-tag deprecation
• PCI Security Standards Council guidance on e-commerce script requirements

Frequently Asked Questions

How do I check whether my Shopify store is redirecting customers to a fake checkout?

Open a fresh private window, add a product to the cart and click Checkout from every entry point, watching the address bar each time. Repeat on desktop and phone in new private windows, because the reported redirect fired only once per browser session. Then list your app embeds and read every custom-code field, since the October cases involved app-delivered code.

Was Shopify's own checkout hacked?

None of the sources I read reports a breach of Shopify's own checkout. The reported redirects came from code delivered through third-party apps on the storefront, before shoppers reached checkout. Vendor and security-firm accounts differ on details, so read each vendor's current notice.

Should I uninstall a Shopify app because it was delisted?

Not automatically. A delisted or unavailable app is a reason to ask the vendor for its status in writing, not proof the app is harmful. Remove an app if you no longer use it, if you cannot get a clear answer from the vendor, or if your own checks find unexplained code.

What are Shopify script tags, and what happens on 1 March 2027?

Script tags let an app load JavaScript on your storefront through Shopify's API. Shopify stops injecting them into storefront pages on 1 March 2027, after blocking new and updated tags from 1 October 2026. Apps need to move to app embed blocks or web pixels, and you may need to switch embeds on in each theme.

How often should I audit my Shopify apps?

Review the full list every quarter, and run the private-window checkout test after every app install, update or theme change. Keep a dated log of what changed. This routine is our recommendation for stores with several apps rather than a Shopify requirement.