Shopify checkout hijack reports: what merchants can check

21 October update: Swym guidance and phased restoration

Swym’s 20 October incident FAQ says it paused app access across its merchants after detecting attempts to insert redirecting code. The company says it revoked Shopify access and rotated credentials. This is an official vendor statement, distinct from the investigator accounts below.

Swym reports no evidence of information being compromised within its app, but warns that shoppers who entered details on the external phishing page may have exposed them. That distinction matters: an app database finding does not establish that shoppers were unaffected.

The FAQ directs merchants to review theme edits attributed to Swym and search theme files for checkout-guard. Have a developer investigate unfamiliar changes and follow Swym’s recovery guidance. Send support the affected page and time if a shopper reports a redirect.

The FAQ describes the pause; the newer service status update at 16:47 UTC on 21 October says Swym is monitoring and continuing to restore merchants in batches. This is not a platform-wide all-clear. Confirm your store’s restoration and next steps with Swym before treating visible wishlist controls as working again.

Evening update: 16 October 2026

The Shopify App Store pages for Hulk Product Options, Swym Wishlist Plus and Selleasy now say the apps are not currently available. We checked all three listings on 16 October. The listing notices do not specify a reason or establish whether an existing installation is safe.

In its own incident statement, updated 16 October, Logbase says an unauthorised script injected into some stores on 13 October redirected customers to an external phishing page. The company says it fixed the root cause within hours, removed the script, contacted affected merchants and engaged an independent security agency.

Logbase says it has found no evidence so far of a breach or leak in Selleasy’s backend or database. It also says Shopify confirmed removal of the malicious code on the same day. These are the vendor’s findings and assurances; we have not independently verified remediation across affected stores. They should not be read as a finding that no shopper information was exposed by the phishing pages.

Merchants using the named apps should review the relevant provider’s current guidance and ask for confirmation about their own store. The earlier HulkApps comment remains attributed and unauthenticated in our reporting; the new Selleasy statement is hosted on its vendor’s own website. We are updating this existing report rather than treating each app reference as a separate incident article.

Two developers have published firsthand accounts of Shopify storefronts redirecting shoppers to imitation checkout pages. The reports warrant a checkout review, but they do not establish how the malicious configuration was introduced or how many stores are affected.

What the investigators reported

In his 10 October investigation, Roman Zipp traced a redirect on MechanicalKeyboards.com to JavaScript delivered through the Hulk Product Options extension. He reported that malicious code was present in a custom JavaScript configuration field. The route by which it reached that field remains unknown.

Zipp said the redirect disappeared from that store after escalation to Shopify. An account identifying itself as the merchant said it disabled the app and tested checkout. That response concerns one store, not resolution of every reported incident.

In a 15 October update, Zipp said six merchants had contacted him and that not all used HulkApps. Separately, developer Dan S. described tracing a similar attack through Swym Wishlist Plus: he reported malicious content in a button-label configuration response and said it was cached in the browser. We reviewed these accounts but have not independently reproduced either investigation.

What merchants can check now

Have your storefront team review recent app and script changes. Check the checkout destination in a fresh private session before entering payment details. The reported behaviour can depend on session state.

If an unexpected payment page appears, stop the test without entering personal or card data. Preserve the time, affected page and screenshots for your technical team, then contact Shopify Support and the relevant app provider. Ask them to investigate the configuration and any browser-cached content before treating removal of an app as complete remediation.

Our source search on 15 October did not locate an official incident statement establishing the cause or overall scope. See the 16 October update below for a subsequently reviewed comment attributed to HulkApps. This report does not establish a platform-wide breach, a compromise of every installation of either app, or a confirmed all-clear.

Update: 16 October 2026

A 15 October comment posted under the name Hulkapps on Zipp’s investigation says unauthorised code was removed, Shopify temporarily disabled and then restored the Product Options extension, and an outside security firm was engaged. We have not independently authenticated the commenter or verified those remediation claims. Our targeted search did not locate the statement on the company’s own site.

Zipp’s merchant-contact count now stands at seven. That is a count of reports received by the investigator, not a verified total of affected stores.