In October 2026, attackers hijacked several third-party Shopify apps and used them to send shoppers to fake checkout pages that captured their card details. The confirmed incidents involved Hulk Product Options, Selleasy, and Swym Wishlist Plus. The attackers went around Shopify’s own checkout, not through it.
Picture a customer who finds something they love in your store, clicks Checkout, and enters their card on a page that looks exactly right. The order goes through. Nothing in your admin looks off.
That’s what made this attack so unsettling: a scammer briefly took over the shopper’s checkout, captured their card, and then let the order go through as usual.
With Black Friday three weeks away, here’s what happened and what to check in your own store.
How did the fake checkout work?
Developer Roman Zipp spotted it by accident on October 10. He was shopping on a Shopify store, clicked Checkout, and landed on a payment page on an unfamiliar domain.
Here’s how the attack worked:
- Some storefront apps load settings from their developer’s servers each time a page loads.
- Attackers got into those settings and slipped in malicious code.
- When a shopper clicked Checkout, the code sent them to a lookalike payment page that showed their real cart.
- After the shopper entered their card, the fake page forwarded them to the store’s real checkout, and the order went through.
The attack didn’t break the purchase. It only needed to sit between the cart and checkout for a few seconds. That’s why affected orders looked completely normal from the merchant side.
Which Shopify apps did attackers hijack?
Three app developers confirmed that an unauthorized party changed what their apps loaded on some stores:
Running one of these apps doesn’t mean attackers reached your store. Each attack hit only some stores, and nothing shows these developers wrote the malicious code themselves.
The fallout was much wider than three apps. Shopify pulled hundreds of apps from its App Store in waves through late October. Some connected to the hijack, and Shopify pulled others for using an unsupported API version. One independent tracker counted 563 delistings between October 14 and 27.
Did the attack affect Ordoro?
No. The October 2026 Shopify checkout hijacking did not affect Ordoro. Ordoro customers don’t need to take any action related to this incident.
It’s still a good moment to look at every app connected to your store. The attack ran through apps that add code to the pages shoppers see, like product options, wishlists, and upsell pop-ups. Those apps sit right where customers enter payment details, so they deserve the closest look.
A 20-minute app check now is worth it before your busiest week of the year:
- List every installed app. In your Shopify admin, go to Settings > Apps. Look for the three apps named above and anything you don’t recognize.
- Remove what you don’t use. An app you tested six months ago may still have access to your storefront.
- Follow developer notices. If you use an affected app, follow that developer’s latest instructions rather than guessing.
- Test your checkout, but don’t rely on it alone. Click through to checkout and watch the web address. This attack was hard to catch this way: the code only fired on a real Checkout click and sometimes didn’t fire at all.
- Take customer reports seriously. In several cases, a shopper was the first to notice something wrong.
If you find a suspicious redirect
- Save screenshots and, if you can, a HAR file (a browser recording of the page activity).
- Disable the app you suspect.
- Notify the app developer, Shopify Support, and your payment processor.
Frequently asked questions
Did hackers break into Shopify’s checkout?
Did hackers break into Shopify’s checkout?No. Nothing shows attackers broke into Shopify’s own checkout or payment systems. The fake checkout pages ran on outside websites, and attackers delivered the malicious code through third-party apps.
Which Shopify apps were involved in the checkout hijacking?
The developers of Hulk Product Options, Selleasy: Upsell & Cross Sell, and Swym Wishlist Plus each confirmed incidents in October 2026. Using one of these apps doesn’t automatically mean a store was affected.
Did the attack affect WooCommerce or BigCommerce stores?
The confirmed October 2026 incidents involved Shopify apps only. Similar risks can exist on any platform where third-party apps add code to storefront pages.
Was Ordoro affected by the Shopify checkout hijacking?
No. Ordoro was not affected, and Ordoro customers don’t need to take any action related to this incident.
How can I tell if my Shopify store was affected?
Check your installed apps against the developer notices, watch for customer reports of strange checkout pages, and test your checkout. Testing alone can miss this attack, so follow developer instructions if you use an affected app.
The takeaway
Third-party apps are part of what makes a Shopify store work, and this incident isn’t a reason to remove all of them. It’s a reminder that every connected tool is part of your customer’s experience, including the ones you set up once and forgot about.
As you add channels and tools, keeping track of what’s connected gets harder. Our guide to multichannel selling covers how growing businesses keep operations organized as they expand.
Getting ready for BFCM? Talk to an Ordoro expert about keeping inventory, orders, and shipping running smoothly through your busiest week.
