Shopify Blocks Fake Checkout Redirects

A checkout hijack campaign ran through three storefront apps for ten days. On October 20 Shopify changed the storefront itself, and merchants still have work to do.

What Happened

On October 20, 2026 Shopify changed how every Online Store handles a shopper about to leave it. The storefront now asks customers to confirm, with the destination address shown, before sending them to a website outside the store. Domains connected to the store and supported Shopify and social sites do not trigger it. An October 23, 2026 update narrowed the rule so that only links Shopify has identified as malicious are blocked outright, while suspicious sites still require a confirmation. Merchants had to do nothing; it shipped already enabled, as the platform changelog records.

The change landed in the middle of an active attack. Independent developer Roman Zipp first traced a checkout hijack on October 10, 2026: code delivered through a storefront app's own settings or theme extension attached itself to the store's Checkout button and sent the shopper to a look-alike payment page on an outside domain, including biliing.top, instead of the real checkout. Card details typed there went to the attacker, and the shopper was then handed on to the genuine checkout, so the order completed and still appeared normally in the admin. Zipp reports the script fired once per browser session, which is why an owner testing in the same tab could see nothing wrong.

Three app vendors confirmed incidents. HulkApps said an exploit introduced unauthorised configurations in Hulk Product Options on October 10. Logbase said an unauthorised script reached some stores running Selleasy between 07:47 and 15:00 UTC on October 13, with no evidence of a backend breach. Swym said activity through Wishlist Plus ran in a 110-minute window on October 14 and a further wave began at 21:17 UTC on October 18, after which it paused the app for all merchants and revoked its Shopify access, so no existing store token works. Shopify has published no list of affected apps or stores.

Shopify's platform response came the same day. Its October 20 advisory, "Securing your app, together", told every app developer to act that week: scan code with the security check added to the AI Toolkit on October 15, move to expiring access tokens, review API logs, and enable two-step authentication. Tighter limits on storefront app code, IP restrictions on app keys, and higher App Store security requirements are planned with no dates. Roughly 450 App Store listing pages read "currently unavailable" between October 14 and 21, about 309 on October 20 alone.

Key Facts

Attack first traced October 10, 2026 by developer Roman Zipp; phishing destinations included biliing.top.
Confirmed apps: Hulk Product Options (October 10), Selleasy by Logbase (October 13, 07:47-15:00 UTC), Swym Wishlist Plus (October 14, second wave from October 18, 21:17 UTC).
Swym paused its app for every merchant and revoked its Shopify access tokens; Logbase reports an independent audit is under way.
Shopify's redirect confirmation went live October 20, 2026 and was narrowed October 23, 2026 to block only Shopify-flagged malicious links.
About 450 App Store pages read "currently unavailable" between October 14 and 21; no source says Shopify's own checkout was breached.

Why This Matters for Shopify Merchants

The damage is deferred rather than immediate. Because the hijacked shopper is handed back to the real checkout, the order completes, conversion holds, and revenue looks untouched for weeks. What comes back instead is fraud: a card number typed into a look-alike page becomes a dispute later, and a chargeback spike hurts a small store far more than lost sales. If you ran any of the confirmed apps, every order from October 10 onward needs a paper trail.

The vulnerable surface was never Shopify Checkout. It is anything that loads code on your storefront, and that category keeps growing. Shop MCP opened cart and Shop Pay checkout to any MCP-capable agent on October 13, and browser agents already reach checkout through WebMCP, so more routes to a purchase means more places a script can rewrite what a button does. Shopify's structural fix is the script tag shutdown: no new or updated script tags after October 1, 2026, existing tags stop loading on March 1, 2027, replaced by app embeds you enable per theme. The same logic drives checkout extensions replacing legacy customisations.

The redirect guard also changes links you never treated as risky. Any domain you own but have not connected to the store, a booking site, a wholesale portal, or a help desk, can now show shoppers an interstitial naming the destination. That is friction on a link you placed deliberately. Connect those domains or expect the prompt, and click through them before holiday traffic does it for you. It belongs in a 90-day Shopify launch plan.

Underneath all of it sits an app governance question rather than a security one. Every storefront app is a vendor you have trusted with your checkout button, and most stores run far more of them than they can name. Our Shopify AI versus third-party apps comparison covers that trade-off, and this incident is the strongest recent argument for retiring an app wherever Shopify's own AI stack already does the job.

What Merchants Should Do Now

Test your checkout in a fresh private window today. Add a product, click Checkout, and confirm the address bar shows your own domain or a myshopify.com URL before any card field appears. Repeat in a new window: the script fired once per session, so a same-tab test can look clean.
Inventory storefront apps and app embeds. Check Settings > Apps, then Online Store > Edit theme > App embeds, and disable anything you do not recognise. If you ran Hulk Product Options, Selleasy, or Swym Wishlist Plus, look for theme file edits those apps made (Swym asks merchants to search for "checkout-guard") and keep order records from October 10 onward.
Connect every domain you legitimately send shoppers to, then click through each one. Editorial links, wholesale portals, and help desks on unconnected domains now show the confirmation message.
Cut app dependency before the next campaign. Enable two-step authentication for staff, remove unused collaborator accounts, and where an app duplicates a native Shopify feature, migrate ahead of the March 1, 2027 script tag shutdown.

Original Source

Original source: Shopify Changelog
Original publication: October 20, 2026 (updated October 23, 2026)
Coverage updated: 2026-10-26