HulkApps, Selleasy and Swym have each confirmed that attackers altered their Shopify apps’ settings to load code that redirected some shoppers from real checkouts to fake payment pages built to collect card details. HulkApps traced it to its Hulk Product Options extension, which Shopify switched off until the code came out, while Selleasy said an intruder got into an internal tool and planted a script in some stores’ settings on October 13. Swym said its Wishlist Plus app was compromised on October 14 and suggested merchants consider alerting anyone who entered card details at checkout that day. None of the three has said how many stores were hit, even though Selleasy alone runs on more than 49,000 Shopify stores.
