Skip to main content
Storefront Signals
Back to Archive

Shopify Dev

Hijacked Shopify Apps Sent Shoppers to Fake Checkouts. Here's What to Check. (opens in a new tab)

Highlights a recent security breach where malicious apps redirected shoppers to counterfeit checkout pages, urging merchants to audit app permissions.

Ethercycle· Oct 20, 2026· 8/10

From the article

Over eight days in October, someone used at least three Shopify apps to send shoppers to fake checkout pages. The shopper clicked Checkout, landed on a convincing copy of a checkout on a .top domain, typed in a card, and was then passed along to the store's real checkout. The order went through. The card number went somewhere else. Here's what's confirmed, what isn't, and what you can check on your own store this afternoon without touching anything. What happened, in order October 10: Hulk…

Read the full article on Ethercycle (opens in a new tab)

Related items