Hijacked Shopify Apps (2026): What Happened in October and What to Check

We're an agency, and recommending apps is part of the job. Some of the apps in this post are ones we've seen and sometimes reccomended on stores we work with.

I audit stores before we quote on them, so I see a lot of app setups. This is where things stood on 29 October, and some of it will change as the app makers publish more.

The short version

*Shopify hasn't published a count or a list. On 29 October HeyApps, a third-party tracker, showed about 570 apps still off the App Store and about 140 back on it (HeyApps). Shopify hasn't said why most of them went. A Shopify partnerships staffer replied on X that only a small share were for security (X). If one of your apps was delisted, that doesn't necessarily mean it was hacked.

What happened in October

On 10 October a developer, Roman Zipp, pressed Checkout on a Shopify store and was sent to a payment page on a domain he didn't recognise, which he traced to Hulk Product Options by HulkApps (Roman Zipp). On 13 October the same thing happened through Selleasy, an upsell app by Logbase, after an attacker got into an old internal support tool (Logbase). On 14 October it happened through Swym's Wishlist Plus (Swym). Around 18 to 19 October, Swym's access to stores was reportedly used again to add scripts to some of them (Fudge).

The fake page was built to collect card details, then sent the shopper on to the store's real checkout, which likely made it easy to miss. The code ran on the storefront and took over the Checkout button (cside). Nothing published so far says Shopify's own checkout was breached (Fudge).

We haven't seen a published count of affected stores or shoppers. In Australia, iTnews reported that WAGD, a dog harness retailer, was hit through Selleasy on 13 October. The owner closed the site, and Shopify asked her to keep password protection on while it investigated. By 19 October she'd been told she could reopen (iTnews).

What Shopify has done so far

None of Shopify's own posts we've read name the attacks or the apps. On 20 October it asked every app developer to act that week, and said attacks on apps are increasing as AI gets better at finding weaknesses (Shopify).

The same day, Shopify started asking shoppers to confirm before following links to outside sites (Shopify changelog). It also popped up on ordinary links, like country switchers and returns portals, and within two days Shopify had turned the broad version off (Shopify Community). Shopify says that since 23 October it only blocks sites it has flagged as malicious, and asks shoppers to confirm on a small number of others (Shopify changelog). There's no setting for it, and if it blocks a good site, Shopify says to contact Support with the address and a screenshot (Shopify Help Center).

On 27 October Shopify told app makers that public apps using the Admin API must move to expiring access tokens by 1 January 2027 or be delisted. The old tokens stop working on 1 April (Shopify).

When an app gets delisted

Delisting stops new installs, and it's separate from removing the app from stores that already have it (Shopify Help Center). Aftersell and Rebuy, two of the delisted apps, say existing stores can keep using them (Aftersell, Rebuy).

Swym went further and paused Wishlist Plus for every merchant (Swym FAQ). Its status page said on 27 October that access was open again, with an outside audit still running (Swym status). Its App Store listing still showed as unavailable on 29 October (Shopify App Store). Selleasy and Hulk Product Options are back on the App Store (Logbase, HeyApps).

If one of your apps went, ask the developer in writing why, and what they found on your store. Before you uninstall anything, export any data you want to keep.

How to check your store

• Open a private window, add a product to the cart and press Checkout on the cart page and in the cart drawer. If your product page has a Buy it now button, try that too, then do it all again on your phone. Express buttons like PayPal can open another site on purpose, so skip those.
• Anything in the address bar other than your own domain or your myshopify.com address needs looking at.
• A clean test today doesn't prove you weren't hit earlier. The HulkApps code only fired once per browser session, and the app makers say it's been removed (Roman Zipp).
• Look for an email from Logbase, Swym or HulkApps. Logbase says it contacted affected stores directly.
• Remove apps you don't use from Settings > Apps. Turning off an app embed isn't the same as removing the app.
• Check your theme files for recent edits nobody on your team made. Swym asks merchants to look for edits made by its app.
• If the checkout goes somewhere it shouldn't, take a screenshot and contact Shopify Support, then the app maker. Closing the store while Shopify looks into it, as WAGD's owner did, might be the safer option.
• If customers typed card details into a fake page, talk to your payment provider and your adviser. Australia's notifiable data breaches scheme might apply, depending on your business and what was exposed (OAIC).

Where that leaves you

If you run Hulk Product Options, Selleasy or Swym Wishlist Plus, test your checkout today and ask the app maker in writing what they found. If you don't, the checks are still worth doing, because Shopify says attacks on apps are increasing.

If you'd like someone to go through your apps, theme and checkout with you, that's part of our support and maintenance work, and we'd like to hear about it.

Written by James Fagan

James Fagan is in Sales and Solutions at Prosper Digital, a Platinum Shopify Partner and Australian Shopify Plus agency. He reads and quotes the briefs that come in, and audits the stores behind them.