Over eight days in October, someone used at least three Shopify apps to send shoppers to fake checkout pages. The shopper clicked Checkout, landed on a convincing copy of a checkout on a .top domain, typed in a card, and was then passed along to the store's real checkout. The order went through. The card number went somewhere else. Here's what's confirmed, what isn't, and what you can check on your own store this afternoon without touching anything. What happened, in order October 10: Hulk…