Other · disclosed 10 October 2026
Shopify apps turned into checkout phishing redirects (HulkApps, Selleasy, Swym)
Malicious JavaScript was delivered through the settings of third-party Shopify apps (Hulk Product Options, Selleasy, and reportedly Swym Wishlist Plus). On a real checkout click it cancelled the navigation and sent shoppers to a lookalike checkout page that captured card details, then forwarded them to the genuine checkout. The apps' own script files were unchanged; the code came from their configuration data. The root cause has not been published.
- Detectable by a website scanYes
- Last reviewed23 October 2026
What to do
- Test your checkout in fresh private windows and confirm the address bar stays on your own domain. Review every app setting that accepts custom JavaScript, remove anything unfamiliar, and uninstall apps you don't need.
Sources
- cside: Inside the HulkApps Shopify checkout hijack
- Roman Zipp: Shopify shops hit with ongoing Checkout Hijack attack
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.