Two Shopify Apps Sent Shoppers to Fake Checkouts. Your App Stack Is Your Attack Surface.

In mid-October, attackers used two Shopify app integrations to redirect some shoppers to fake checkout pages built to collect card details. Nobody hacked the merchants' stores. The code that did it arrived through apps the merchants had installed and trusted.

What happened

On 13 October, Logbase said its Selleasy app was the victim of a "deliberate, planned cyber-attack." An unauthorised script was injected into some of the stores it serves between 07:47 and 15:00 UTC, and it pushed customers to a phishing page. Logbase says it was removed the same day.

A few days earlier, developer Roman Zipp spotted HulkApps' Hulk Product Options sending shoppers to a fake checkout. HulkApps said unauthorised configurations had altered its theme extension. Shopify temporarily disabled the extension while the code was removed. Zipp says seven merchants reported the same hijack, and not all of them used HulkApps.

As of 16 October, both apps were listed as "not currently available" in the App Store. Neither developer has said how many stores were hit.

How the attack worked

This is the part worth reading twice. The app script fetched its settings from the vendor's servers, including a custom JavaScript field, and then ran whatever came back. Once attackers got into that settings pipeline, they didn't need to touch a single store.

The injected code did three things:

• Intercepted clicks on the checkout button
• Sent the shopper to a lookalike payment page on a throwaway domain
• Ran once per shopper, then let them through to the real checkout on the next try

That last point is nasty. A merchant who tests their own checkout twice will see nothing wrong. Your support inbox, with confused customers asking why they were charged twice or never got a confirmation, finds it before you do.

The real problem is remote code you don't own

Most Shopify stores run somewhere between 10 and 30 apps. Each one can ship JavaScript to your storefront, and plenty of them load configuration from someone else's server at runtime. That is remote code execution by design, sitting on the one page where customers type their card number.

We build on Shopify a lot, and we see the same pattern everywhere. Apps get installed during a campaign push, nobody removes them, and nobody reads what they inject. Fixing that is dull work. It is also the work that would have limited the damage here.

What to do this week

1. Test checkout properly. Open a fresh private window, add an item, click checkout, and confirm you land on your real checkout domain. Do it on mobile too.
2. List every app that touches the storefront. Check theme app extensions, script tags and any custom JavaScript fields inside app settings. If an app lets you paste JS into a box, treat that box as production code.
3. Remove what you don't use. An abandoned app with live permissions is a free door.
4. Lock down accounts. Rotate staff and developer passwords and turn on two-factor authentication everywhere.
5. Watch your checkout funnel. A sudden drop between "checkout clicked" and "checkout started" is a signal worth alerting on.

If you think customers entered card details on a fake page, contact the app developer and Shopify immediately, and check your breach notification obligations in your region.

Takeaway

Platform security keeps the core of Shopify safe. It does not review what every app decides to fetch and run on your storefront next Tuesday. Treat your app list like a dependency tree: pin what you can, prune what you can't justify, and assume one of those vendors will have a bad day eventually.

We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!