Urgent (Oct 15, 2026): Shopify Checkout Redirects via Third-Party Apps — What Merchants Should Check Now

Last updated: October 16, 2026

What Happened

On October 15, 2026, reports of this issue spread rapidly across the Shopify community. The underlying risk, however, appears to have been present since at least October 10. Please check your store now rather than waiting for official findings.

Since October 10, several merchants and agencies have reported that some customers clicking Checkout were redirected to a fake payment page. The reports point to code delivered through certain third-party apps, not to Shopify's own checkout. The full scope is not yet known and no official findings have been published. As a precaution, merchants who use Swym Wishlist Plus or a HulkApps extension should review those apps and check their checkout.

This article explains what has been reported, what is still unknown, and what Japanese merchants can do today and over the longer term. Details are still emerging, so we date-stamp what we know as of October 15, 2026. The reports are being discussed in English-language channels such as LinkedIn and the Shopify Community forums, but we have seen almost no coverage in Japan so far, so we wanted merchants here to hear about it early and know what to check.

The main reports so far, and the cases Flagship has confirmed, are below. They describe the same outcome through different apps:

Date	Report	App Named
Oct 10	Developer Roman Zipp, shopping on a US keyboard store from Germany, is redirected at checkout to a lookalike domain. He traces it to injected code and reports it.	HulkApps Product Options
Oct 13	A merchant on the Shopify Community forum says a customer was sent to a fake payment page.	None confirmed; the merchant says they do not use HulkApps
Oct 15	Shopify Partner Underwaterpistol reports observing a live hijack on a client store and traces it to Swym's configuration service.	Swym Wishlist Plus
Oct 15	Flagship confirmed separate occurrences of the same redirect on different merchants' stores.	Swym Wishlist Plus

Other merchants and agencies in the replies to Underwaterpistol's LinkedIn post say they have seen similar redirects, with one naming a third app, Selleasy, for which the commenter says Shopify Support described the issue as mitigated. Apart from the cases Flagship confirmed, none of those further reports is confirmed, and nobody has established whether the incidents share one cause.

What the Companies Are Saying

As of October 15, 2026, 19:30 JST, we searched the pages of the apps named (Swym, Swym status, HulkApps) and Shopify's status page, and found no public statement about these reports. Since then, HulkApps has responded in a LinkedIn thread: it says unauthorized configuration changes affected its Product Options theme extension, that its security team removed them working with Shopify (which temporarily disabled the extension), that the extension was restored once Shopify confirmed the fix, and that merchants do not need to uninstall it.

Swym has not published a public statement yet, but has told at least one merchant directly that the issue has been contained, that Shopify has temporarily delisted Wishlist Plus for new installs while safeguards are put in place, and that a detailed update will follow within 72 hours. The StatusGator tracker for Swym lists only an unverified user report from October 14 of a store "hacked" through the wishlist button. As of October 16, a comment in the LinkedIn thread says Swym has deployed a fix, but we have not seen an official statement from Swym.

Separately, on October 15 Shopify released a command for app developers that checks an app for common vulnerabilities (shopify app security check; see the Shopify developer changelog). It is not something merchants run on their own stores, but it is a step toward safer apps.

What Is Actually Happening

The reports describe malicious code arriving through an app's own remote configuration, not through the merchant's theme files. Theme code can look completely clean while the app still loads something harmful from its vendor's servers at page load.

In the original LinkedIn post about Swym, the app's configuration service returned a very long string where a plain text label such as "Add to Wishlist" should be. The string contained a hidden broken image with an error handler (onerror). When the app's script inserted that label into a button as HTML, the handler ran. This is a stored cross-site scripting (XSS) problem: a data field became a way to run code.

In the first public report about HulkApps, a field designed to hold custom JavaScript, around 22.7 KB in size, was returned by the vendor's API and run in the visitor's browser. Once running, the code does the same things in both reports:

• It watches checkout buttons and cart form submissions, and sends the shopper to a lookalike domain.
• It copies the real cart, including products, quantities and totals, so the fake page looks right.
• It shows a fake form asking for contact, address and card details.

How to spot the fake page: the address bar does not show your store's or Shopify's domain, prices or totals may be wrong, the shop logo at the top may not match, and a password manager may offer a credit card's first name for the "First name" field, a sign that the form is collecting card details. Always check the address bar before entering anything.

Example of a fake checkout page. Screenshot courtesy of Roman Zipp, from his article.

Domains named in the public reports (do not visit them):

• biliing.top
• billing-confirm.top
• account-confirm.top
• checkout-confirm.top
• order-confirm.top

Other domains may be used, so any unfamiliar address at checkout should be treated as suspicious.

Why It Is Hard to Spot

The reported behavior makes this easy to miss, so a quick test of your own checkout may show nothing.

• It may not repeat: The HulkApps script reportedly runs once per browser session, so a second test in the same window looks normal. A merchant also reported that later attempts worked fine after a customer was redirected.
• It can survive removal: The Swym configuration was cached in the browser's Local Storage, so the malicious handler can persist after the app is disabled, and the vendor's server reportedly served it again after the cache was cleared. Merchants cannot clear this cache from shoppers' browsers themselves; it goes away only once the vendor fixes the configuration on its servers. This is one more reason to turn off the app's embeds.
• Orders may still arrive: If the shopper is forwarded to the real checkout after their details are taken, you could see a normal sale and no complaint. This is possible behavior, not something the reports have confirmed.
• Standard defenses may not help: The reporting says the domains were not yet flagged by Google Safe Browsing or URLhaus, and ad blockers did not stop them.

Because of this, a clean test is not proof of safety. Stores that use their own wishlist buttons may show no visible redirect, but cached code can still sit in shoppers' browsers.

What to Do Now

If a redirect is confirmed, act before you know the cause. Should shoppers be sent to a suspicious payment page, switch off the app, or the specific embed, that you suspect while you investigate. If you cannot find the source quickly and customers are still exposed, closing the storefront for a while may be the safer choice. Waiting for a full explanation is not a reason to leave the problem running.

The steps below start with checks any store can run now:

1. Check your apps: Look for Swym Wishlist Plus and any HulkApps extension (for example Product Options or Form Builder) in your app list.
2. Test in clean sessions: Use fresh private windows, add a product, press Checkout from the cart page, the cart drawer and any quick-buy buttons, and confirm the address stays on your Shopify checkout domain. Repeat several times. The malicious code is reported to set a flag in the browser's sessionStorage after redirecting once and not to fire again in the same session, so in a normal window that flag may already be set and checkout can look fine even on an affected store. Always use a fresh private window. Instead of testing by hand, you can also use a community-built checker (The fake register, Very Bad Panda), available as a Claude Code plugin and as a prompt for Claude in Chrome. It opens checkout three times in new tabs and records the landing address and any suspicious storage keys or network requests. Use it only on stores you own or manage, note that each run creates one abandoned checkout, and treat a pass as a snapshot, not a guarantee.
3. Check and clear cached data between tests: In DevTools, open Application, then Local Storage, and look at keys from the app (for example ones starting with swym) for anything containing onerror or .top. Also check Session Storage for keys starting with __ctf_; the reported malicious code is said to use this key to run only once per session. If you find any, take a screenshot or save the value before deleting it, as it is evidence. Clear them between tests, since cached app configuration may persist.
4. If you confirm a redirect, capture evidence and escalate: Before changing anything, keep screenshots, URLs, timestamps, and network responses. Then put up the storefront password page and contact Shopify Support and the app vendor. If customers may have entered card details, involve your security, payments, and legal teams early and check your reporting obligations. In Japan, besides the Personal Information Protection Commission, you may also need to report to your payment service provider or card companies under the Credit Card Security Guidelines.
5. Disable Swym until further notice: If you use Swym Wishlist Plus, turn off all of its app embeds in the theme editor under App embeds until further notice. HulkApps says its issue is fixed and that uninstalling is not necessary, but confirm with the tests above. If you see a redirect with any app, disable that app in the same way. Some apps have more than one embed, and they are not always obviously labelled. If you have an older theme that does not use app embeds, check theme.liquid for scripts from the app and comment them out. Scripts loaded directly by the theme can keep fetching the app's configuration even after the app is uninstalled. If you do not need the app, uninstalling it is the most complete option. After turning an app off, also check the Network tab in your browser's DevTools for requests to that app's servers.
6. Check other script-injecting apps: Reports name other apps as well, including Selleasy, and some merchants say they were affected without the two named apps, so review every app that adds code to your storefront.
7. Secure your accounts: Change passwords and enable two-factor authentication for Shopify staff accounts and app dashboards, and remove users you do not recognise.
8. Watch for customer reports: Ask support staff to flag complaints about odd checkout pages, and recommend customers check the address before entering card details.

Longer-Term Takeaways

This incident is a reminder that every app which injects code into your storefront is part of your checkout's security.

• Keep an inventory: List every app, embed, and tag that adds scripts to your storefront, who installed it, and who is responsible for it.
• Remove what you do not use: Each unused app is a remote code path you no longer control.
• Ask vendors the right questions: What code runs on install, what remote content it fetches later, how that content is inserted into the page, who can change the remote configuration, and whether anything is cached in the browser.
• Set up regular checkout tests: Test from clean sessions on a schedule and after every app change, on both mobile and desktop.
• Know your escalation path: Decide in advance who contacts Shopify Support, who switches on the password page, and who talks to customers.
• Harden access: Use two-factor authentication and the least privilege needed for staff and partner accounts.

Keeping Perspective

In the reports where a source has been identified, the malicious code came from third-party app content loaded into the storefront. None of the reports points to a problem in Shopify's own checkout, and Shopify has responded quickly: according to HulkApps and Swym, it temporarily disabled the affected HulkApps extension until the fix was confirmed, and delisted Wishlist Plus for new installs while safeguards are put in place. Any platform with a rich app ecosystem faces this class of risk, and the lessons above apply wherever third-party scripts run.

The same is true of open source packages and other external scripts: vulnerabilities can arrive through dependencies. In Japan, for example, suspicious login screens appeared on the websites of companies including MUJI and Toshiba in late May and early June 2026, and many of them said the screens came through the polyfill.io library (ITmedia, in Japanese). Keep an inventory of what you use and monitor it.

Vulnerabilities like this can appear in any software that loads content from outside a store, and any app vendor could face them. We work with many vendors, including the ones named here, and our aim is to help merchants check their own stores, not to assign blame. We expect vendors to share details as soon as they can.

We learned of this through developer and agency posts on social media, well before any formal notice, and began auditing the stores we support the same day. We will continue to gather information, monitor the situation, and update this article and the community if we learn anything new or important.

Update history

• October 16, 2026: Added Shopify's security check command, the report of a Swym fix, and a community-built store checker
• October 16, 2026: Published (based on information as of October 15, 2026)

References

• Shopify hit with phishing attack (Roman Zipp)
• Dan Sutherland's LinkedIn post on Swym Wishlist Plus
• Shopify Community thread: checkout phishing redirect
• Swym status history (StatusGator)
• Suspicious login screens on Toshiba, MUJI and other company sites (ITmedia NEWS, in Japanese)
• Build with confidence: Shopify AI Toolkit's security check (Shopify developer changelog)
• The fake register: how a script tag hijacked Shopify checkouts (Very Bad Panda)
• Checked for official statements: Swym product updates, Swym status, HulkApps blog, Shopify developer changelog, Shopify status