On this page
Shopify merchants should test their checkout in a fresh private window today and check whether Selleasy, Hulk Product Options or Swym Wishlist Plus is installed. In October 2026 these apps were reported to have run code that sent some shoppers to lookalike payment pages. Ask each vendor in writing what was changed in your store and when it was removed.
| Fact | Detail | Source |
|---|---|---|
| What happened | Vendors say an unauthorised script or configuration was added to their app and sent some shoppers to a phishing page. Shopify has published no account of its own that we found | Logbase, Swym FAQ, Zipp |
| Hulk Product Options | Redirect found by researcher Roman Zipp, discovered 10 October 2026 per his log. HulkApps is quoted there saying an exploit introduced unauthorised configurations into its theme extension. We found no HulkApps or Shopify page of their own on what was disabled or removed, so we state nothing on that | Zipp |
| Selleasy (by Logbase) | Logbase's notice (updated 16 October 2026) dates the incident to 13 October, says an unauthorised script was injected into some stores and redirected shoppers to a phishing page, and reports Shopify confirmed the code was removed the same day. Logbase says it found no evidence of a breach of the Selleasy backend or database | Logbase |
| Swym Wishlist Plus | Swym's FAQ of 20 October says it paused the app for every merchant and revoked its access to Shopify. Swym's status page later reports merchants being re-enabled on 22 and 23 October, with access restored gradually and staged deployment still in progress at our check on 24 October 2026 | Swym FAQ, Swym status |
| Number of stores | Not stated by any vendor or by Shopify that we found. Zipp says it is unclear how many stores are affected. iTnews reports a Logbase claim of more than 49,000 active Selleasy stores, which is its install base and not a count of affected stores | Zipp, iTnews |
| Cause | Unknown. Zipp lists how the script entered as an open question | Zipp |
| Checked | At our check on 28 October 2026. The Swym status page could not be opened that day, so its entries are as read on 24 October | this page |
Who is affected?
A store is in scope if it had one of the named apps installed during the reported windows: Hulk Product Options around 10 October, Selleasy on 13 October, per Logbase's notice, Swym Wishlist Plus in the week before Swym's 20 October page. Shopify has not published a list of affected stores or apps that we could find. The vendors have not published store counts either. Lists of "delisted apps" circulate on social media with counts that disagree. Zipp names further apps as unconfirmed (Zipp). We do not repeat them. A delisted app is not proof of an incident, and a missing name is not proof of none.
If you do not know which apps your store runs, open Settings, then Apps in your Shopify admin. Swym also refers to app embeds in the theme, so check the theme editor as well (Swym FAQ).
Why might a quick theme search find nothing?
Zipp traced the Hulk redirect to a file named hulkcode.js, served from the Shopify CDN, which on page load asks HulkApps' API for a custom JavaScript setting of about 22.7 kilobytes (Zipp). The redirect code therefore lived in the app's server-side configuration and not in the loader file. That is why searching your theme files can come back empty on a store that was redirected. Swym's own advice is to look in Online Store, Themes, Edit code for edits made by the Swym app and search for "checkout-guard" (Swym FAQ). That is a good check for Swym. It does not cover the other two.
The second trap is timing. Zipp writes that the script "only ever activates once per user and shop" and sets a flag in the browser's session storage to record that the shopper was already redirected. He does not say it fires once per session or once per visit. HulkApps is quoted there saying the redirect "was not successful for every visit", and a merchant told Zipp theirs stopped with no action taken (Zipp). iTnews reports a once-only description too, and says Logbase told it the Selleasy redirect did not work on every visit and some browsers blocked it (iTnews). A clean test is weak evidence.
How do I fix it and check my store?
How do I check with my own eyes?
- Open a new private window. Add an item, press Checkout, and read the address bar. Repeat in another new private window, on a phone and on a desktop.
- Ask staff and customers whether anyone saw a checkout page with an address that was not yours. Ask for the page and the time, as Swym does.
- Record the date and result of each test. You will want it for the vendor and your payment provider.
What do I ask the app vendor?
Send each of the three vendors, if you had their app, this question and keep the reply:
For [your store domain], what was changed in my store's settings or theme extension by the unauthorised activity in October 2026? Please give the dates it was active, the date it was removed, whether anything remains in my theme or app settings, and whether any shopper data from my store was exposed.
Vendor contact for Swym is support@getswym.com, and updates are on status.getswym.com (Swym FAQ).
What do I change in my Shopify admin?
- Review the apps list and remove any you no longer use.
- If Swym was installed, search theme code for the string Swym names and revert unrecognised edits to earlier versions. Swym says to consult your developer first (Swym FAQ).
- Change your Shopify password and turn on two-factor authentication. Swym says the activity used the app's access and not staff accounts, so this is good practice rather than a fix for this incident (Swym FAQ).
- If any shopper reported a redirect, tell your payment provider and consider writing to customers who checked out in the window. That step is our advice, not a vendor instruction.
Block or monitor the domains published by Swym (checkout-guard[.]top, account-confirm[.]top, billing-confirm[.]top and checkout-secure[.]top) and by Zipp from the Hulk configuration (biliing[.]top, checkout-confirm[.]top and order-confirm[.]top). Logbase's notice names no domains. Do not visit them. Zipp noted some were not yet on public blocklists when he checked, so a clean blocklist lookup proves nothing (Zipp).
Am I affected? Where you stand right now
Am I affected? Where you stand right now
Whether your store was redirected depends on which apps ran on it and when. A look from outside at one session cannot settle that.
- Detected You reproduced a redirect, found a vendor-published domain in your theme or app settings, or a customer reported one. Remove or disable the app, keep the evidence, and ask the vendor the question above.
- Unknown One of the named apps was installed and you saw nothing. This is the common case. For Hulk Product Options, [Zipp](https://romanzipp.com/blog/shopify-hit-with-phishing-attack) reports the script activates once per user and shop and, per HulkApps, was not successful on every visit; we found no primary source that says this for Selleasy or Swym. Get the vendor's written account for your store.
- Confirmed by owner evidence The vendor has told you in writing what ran on your store and when it was removed, and your own tests after that date reach your real checkout. Your store was cleaned of what the vendor found. Questions about shoppers in the window stay open.
No scan, ours included, moves you from "unknown" to "confirmed".
Was anyone's card data taken?
Swym says it had no evidence at 20 October that merchant data or customer personal information was compromised through the app, and that customer data may have been exposed on affected stores if shoppers were redirected and entered their details on the external site (Swym FAQ). Logbase's notice (updated 16 October 2026) says it found no evidence of a data breach or leak on the Selleasy backend or database and does not say whether shoppers entered details on the fake page (Logbase). We found no primary source that counts affected shoppers or confirms stolen cards. Use "redirected" for what is reported and "compromised" only where you have evidence on your own store.
What did Shopify say?
On 20 October Shopify's developer changelog asked every app developer to act that week on security steps, and said developers are accountable to fix a problem and notify affected merchants (Shopify changelog). That post names no incident and does not mention redirects.
Shopify's own changelog has an entry dated 20 October, "New protection against unexpected redirects": a store now asks customers to confirm before sending them to a website outside the store. A 23 October update to that entry narrows it. The store now blocks only links to sites Shopify has identified as malicious and asks for confirmation only for sites it considers suspicious, and other external links open directly (Shopify changelog). Zipp notes that Shopify did not mention the compromised apps in it (Zipp).
On 27 October a comment on Zipp's log, attributed to Selleasy, says the app passed Shopify's security checks and was re-listed. We found no Shopify or Logbase page that confirms it, so ask Logbase in writing before you reinstall.
A separate case, with its own merchant checklist for delisted apps: Aftersell says it also had an incident and was temporarily unavailable on the App Store, and says it involved no malware or phishing. It gives no incident date and does not describe a checkout redirect (Aftersell). Do not read it as part of this one without a source that says so.
What does this mean for the rest of your stack?
This incident is about third-party apps around a store. It is a different problem from the PHP engine bug covered in PHP2Shell. The full list of October incidents covers the others, and October 2026 incidents for small businesses says what a small shop should do first. A vendor script changing under you is not new: Brevo's altered scripts in September 2026 are the same pattern on other sites, and keeping a written inventory of payment-page scripts is how a small store notices it. The other ecommerce guides cover Magento and WooCommerce.
Questions people ask
How do I know if my Shopify store was redirected to a fake checkout?
Open a fresh private window, add a product to the cart and press Checkout, then read the address bar on the page you land on. Zipp reports the Hulk script activated only once per user and shop and left a flag in session storage, so a repeat test can miss it. If you land anywhere other than your own checkout, take a screenshot with the address and contact the app vendor and Shopify.
Which Shopify apps were involved?
Logbase published a notice for Selleasy, HulkApps is quoted in Roman Zipp's log on Hulk Product Options, and Swym published its own incident page for Wishlist Plus. Other apps appear on lists in circulation, but we found no vendor or Shopify statement for them. Treat an app as involved only when its vendor or Shopify says so.
Do I need to uninstall the app, or is disabling it enough?
Swym suggests turning off its app embeds until it says the app is restored. The sources do not give a single rule for every app. Ask the vendor in writing what was changed in your store, when it was removed, and whether anything remains in your theme or app settings.
Did customers who checked out during the incident lose card data?
Swym says customer data may have been exposed on affected stores if shoppers were sent to an external site and typed their details there. Logbase's notice (updated 16 October 2026) does not say whether shoppers entered details on the fake page. Whether any individual shopper did is unknown from outside, so tell your payment provider and consider telling those customers.
Is my store safe if the apps are uninstalled and my own test shows no redirect?
Not proven. A single clean test only shows that one session reached the real checkout, The redirect did not succeed on every visit even while active, according to HulkApps and Logbase. Evidence from the vendor and from your own admin gives you a firmer answer.
Sources
- Wishlist Plus security incident FAQ (Swym, dated 20 October 2026)Swym's own account: app paused for every merchant, credentials revoked and rotated, what to check in your theme.
- Selleasy incident notice (Logbase, updated 16 October 2026)Logbase's own account: incident date 13 October, script removed the same day.
- Wishlist Plus incident updates (Swym status page)Dated status updates, including merchants re-enabled on 22 and 23 October.
- Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (iTnews, 16 October 2026, updated 17 and 19 October)Press report on the Selleasy and Hulk Product Options incidents. Secondary: used only where labelled as reported by iTnews.
- Shopify checkout hijack research log (Roman Zipp, first published 10 October 2026, last update noted 22 October)The researcher who found the Hulk Product Options redirect. Vendor statements on this page are quoted from comments, so they are secondary. Zipp is the primary source for the Hulk mechanism and the domain list.
- Securing your app, together (Shopify developer changelog, 20 October 2026, updated 27 October)Shopify's request to app developers. It names no incident and does not mention redirects. Checked 28 October 2026.
- New protection against unexpected redirects (Shopify changelog, 20 October 2026, updated 23 October)Shopify's own entry: storefronts ask customers to confirm before sending them to a site outside the store. Checked 28 October 2026.
- Aftersell incident disclosure (Aftersell)A separate incident. Aftersell says it involved no malware or phishing and gives no incident date.
Facts on this page are dated and point at the primary source next to them. If a vendor status changes after the date shown, the vendor's page wins; tell us at support@run.cloud and we will update it.