Shopify and its app developers spent the last two weeks cleaning up after attackers hijacked the checkout buttons on an unknown number of merchants’ stores, beginning on October 10.
The attackers didn’t touch Shopify’s own systems. Instead, they broke into third-party apps and used them to send shoppers to fake payment pages built to steal card details. Within two weeks, about 480 apps had disappeared from the App Store, and Shopify still hasn’t publicly explained most of the removals. There’s also been at least one attack on a Shopify app unrelated to the hijacked checkout buttons.
I’m no security expert, but here’s what I’ve been able to piece together from vendor statements, developer trackers, and Shopify’s changelog. The full picture is still a bit blurry, so don’t take this information as 100% fact, though I’ve done the best I can to fact check.
What we know so far:
- Shopify itself wasn’t hacked. Attackers got into the back ends of third-party apps and changed settings that the apps’ scripts load from the vendors’ own servers. Nothing was written into merchants’ themes, so you won’t find anything weird digging through your code.
- The scam was a fake checkout. When a shopper clicked Checkout, the injected code sent them to a lookalike payment page, grabbed their card details, showed a payment error in some cases, then bounced them to the real Shopify checkout, leaving the shopper none the wiser.
- It started October 10. Developer Roman Zipp caught it while shopping on a mechanical keyboard store and traced it to Hulk Product Options. He’s been running a public tracker since.
- Three vendors have confirmed their apps were used: HulkApps, Logbase (Selleasy), and Swym, which later paused its app for every merchant after seeing more injection attempts.
- Shopify disabled Boost AI Search & Filter on October 17 over a “security issue.” Boost’s status page confirms the app was switched off for about a day and has since been restored, but Boost hasn’t said whether it was part of the checkout hijacking or something else entirely.
- Nobody knows the scale. None of the vendors has said how many stores were hit or how many shoppers handed over card numbers — even though Selleasy alone runs on more than 49,000 stores. We also don’t know whether this was one attacker or several running the same playbook.
- Wallet payments mostly dodged the issue. Shoppers who typed a card number were exposed, while Shop Pay, PayPal, and Google Pay weren’t hit the same way, since they log shoppers in through the wallet’s own system and never hand the card number to the page.
- Then came the “App-ocalypse.” About 480 apps left the App Store between October 15 and 23, including Rebuy, Privy, Consentmo, 17TRACK, Bold, and Rokt’s Aftersell and Upcart. About 41 have since come back.
- Delisted doesn’t mean hacked. Shopify hasn’t explained the removals, and most probably have nothing to do with the hijacking. Aftersell, for example, says it had a separate attack that exposed upsell settings for 22 stores, with no checkout redirects, and it’s still waiting to get relisted.
- Delisting doesn’t automatically switch an app off on stores that already have it installed. Those apps just can’t be installed by new merchants, which is extra devastating to app developers as we approach Black Friday.
- Shopify’s response so far: On October 20 it told app developers to harden their apps “this week” and added a warning before shoppers leave a store for an outside site. Three days later it walked that back, so now it only blocks sites it has flagged as malicious and asks for confirmation on ones it considers suspicious. More on that later in Section #9.
Meanwhile, in the same week…
While Shopify merchants were busy running incognito checkout tests, the rest of the Internet got its own scare. On October 21, the PHP Foundation pushed emergency patches for “php2shell,” a pair of critical flaws that let an attacker run code on a web server with one crafted request and no login. Palo Alto Networks counted 22.6M instances potentially exposed. PHP runs a huge part of the web — WordPress, WooCommerce, Magento — so the vulnerability is far-reaching.
Here’s the wild part: the bug had been sitting in PHP for 14 years, but Calif, OpenAI, and Wiz only recently each found pieces of it independently using various AI models.
October 2026 will forever be remembered as a glimpse of what’s to come.
AI just found a bug that humans missed for 14 years, and attackers have the same tools. The same week, The Information reported that a hacking group called CyberCartel used AI agents built on Claude, Grok, and Kimi to automate attacks on 400-plus Latin American financial firms with little human effort. The tools that find holes now also exploit them, and they’re getting cheaper and faster by the day.
