Shopify Checkout Hijack: What to Check Before Black Friday

A Shopify checkout hijack campaign ran through October 2026 and turned ordinary apps into a route to fake checkout pages. Shoppers typed card details into a lookalike page on a domain the merchant did not own. The order then completed normally, so nothing looked wrong afterwards.

The short answer: the malicious code did not live in merchant theme files. It sat in app settings that each vendor's script loaded from the vendor's own servers. That means you could not find it by reading your theme, and a single test could miss it.

What happened, in order

Researcher Roman Zipp reported on October 10 that he clicked Checkout on a live Shopify store and landed on a lookalike checkout on an unfamiliar domain. His card details went to an attacker's server, then he was passed to the store's real checkout so an order would have completed normally.

According to Zipp's running tracker, the wave widened quickly. Hulk Product Options was reported on October 10. Selleasy followed on October 13, where an attacker used an internal vendor tool to inject a phishing script into some stores. Swym Wishlist Plus reported an unauthorised configuration change on October 14, with a second wave on October 18.

Shopify disabled Boost AI Search & Filter on October 17 over a security issue, and the app is no longer listed publicly. Privy and Consentmo also left the App Store with no public statement. Zipp is explicit that the origin of the malicious code remains unclear, and that the campaigns are not all proven to be connected.

How the attack actually worked

This matters more than the vendor list, because it tells you where to look.

The merchant's theme contained no malicious code. Attackers put code into settings fields that each app's script fetched from the vendor's servers. When a shopper clicked Checkout, that code redirected them to a fake page on another domain.

Three consequences follow from that design:

1. Your theme files look clean. There is nothing to find by opening your theme code editor.
2. It does not fire every time. Scripts ran once per visitor, and some browsers blocked them, so one test can come back clean while the store is still compromised.
3. Typed card numbers were exposed. Wallet payments like Shop Pay and PayPal were largely spared, which is the opposite of the reassurance merchants usually assume.

What Shopify changed

Shopify shipped protection against unexpected redirects on October 20. After a further update on October 23, the storefront blocks links to domains Shopify has identified as malicious and asks shoppers to confirm before sending them to sites it considers suspicious.

That reduces the damage, and it is a real improvement. It does not replace checking your own apps, because it acts at the point of redirect rather than at the point of injection.

The 15-minute test to run now

Run this in a private window on a desktop, and repeat the checkout step several times in fresh windows because the script does not fire consistently.

1. Add a real product to the cart and click Checkout. Confirm the domain in the address bar is your own.
2. Open your theme editor and list every app embed. Then list every app installed in your admin. Remove anything you do not actively use.
3. Open each app's settings and look for custom JavaScript or HTML fields. Those fields are where the attacks lived.
4. Turn on two-factor authentication for every staff and collaborator account, and for each app's own login.
5. Note what each critical app replaced. If it switched off a native theme section such as your product grid, you have no fallback if it fails.
6. If you did see a redirect, contact Shopify Support, disable the suspected app embed, and check your notification duties under your payment processor agreement and local law.

Zipp adds two steps worth doing regardless: change your Shopify password, and review which tools, including AI tools, currently have access to your admin.

What this means for how you build a storefront

The uncomfortable finding is that the attack surface scaled with the number of apps that can inject script. A store with nine app embeds on the product page has nine third-party dashboards that can change what loads there. A store with two has two.

That is the practical argument for buying storefront features as part of a theme rather than as separate subscriptions. It is also, plainly, the argument for our own product, so weigh it with that in mind. The honest limitation is that a theme cannot protect you from an app you still need: email, support desks, subscriptions and tax tools remain third-party code on your store.

We covered the money side of this in our app cost breakdown and the app-only store build. The security angle is the same argument with worse consequences.

Why timing is tight

Black Friday is Friday 27 November 2026, and Cyber Monday is 30 November. Most merchants freeze code a couple of weeks before, which puts any app change you plan to make inside the next fortnight.

A hijack discovered during that week is far worse than one discovered now. Traffic is at its peak, support is at its busiest, and every fix competes with the sale itself.

7-day free trial · all themes included · cancel anytime