Ongoing Shopify checkout hijack: the checklist to run before your customer's card gets hit
By Arash Latifi — Founder, The DevArt
An active campaign since early October 2026 is sending shoppers at Shopify stores to fake checkout pages via injected JavaScript — not a hack of your store, but of your apps. What's happening, a 5-minute check, and what to do.
TL;DR — Since early October 2026 an active "checkout hijack" campaign injects malicious JavaScript through apps like HulkApps, Swym Wishlist Plus, Selleasy, and Hextom, redirecting shoppers at checkout to fake pages that steal card details. Your store isn't hacked; the apps are serving malicious code via their own APIs. Run the incognito checkout test, remove apps you don't need, rotate passwords — today.
What's happening
German developer Roman Zipp, mid-purchase on mechanicalkeyboards.com, noticed that clicking Checkout sent him to a strange domain, biliing.top, with a page styled to look exactly like Shopify checkout. Debugging in Chrome DevTools, he found a runtime-injected script that hijacks the checkout button's click and redirects the buyer to a phishing page.
The scarier detail: he later found a Reddit post from a vape-shop owner, 18 days older, reporting the same issue with the same domain. Reported, yet the attacks kept running.
As of October 15 the campaign is still active. What store owners need to know:
- The malicious code does not come from the apps' code directly — it's injected through the app developers' APIs. Auditing the app source won't catch it.
- Apps involved so far: HulkApps (Hulk Product Options), Swym Wishlist Plus, Selleasy, Hextom (in August) and Qikify (in July).
- The phishing domains were not blocked by Google Safe Browsing or URLhaus (
biliing.top,checkout-confirm.top,order-confirm.top). - By October 15, seven different merchants had reported the same hijack — and some of their stores didn't even have HulkApps installed, meaning at least one more app is acting maliciously.
- The DNS records for the phishing domains have since been removed — which likely means new domains, not the end of it.
Why this matters beyond Shopify
Even if your store isn't on Shopify, the lesson is direct: every third-party script you add to your storefront — chat widgets, discount tools, wishlist plugins, analytics — is an injection pipeline into your customer's browser. You're accountable for code you don't see and that doesn't come from your server. A "harmless" app pushing routine updates today can serve a phishing page to your customers tomorrow — and it's your brand that burns, not the app's.
Simple rule: every installed app needs a measurable reason to exist (more sales, retention, a real need). An app with no data behind it is an app you can remove.
Run this checklist today
- [ ] Open your installed apps list and remove anything you don't actively use — especially HulkApps, Swym, Selleasy, Hextom or Qikify if you have them
- [ ] In an incognito window, add a product to cart and hit Checkout; look closely at the final URL — it should be
checkout.shopify.comor your own configured domain - [ ] If you land anywhere strange, report it to Shopify Support immediately and disable the suspect app
- [ ] Change your Shopify admin password
- [ ] Change your passwords on the app vendors' own panels (HulkApps/Swym/Selleasy dashboards)
- [ ] Report the suspicious domains to Google Safe Browsing so they get blocked
- [ ] Turn the incognito checkout test into a weekly routine
Summary table
| Item | Details |
| --- | --- |
| Attack type | Checkout hijack / card phishing |
| Injection path | Shopify app developers' APIs (not the apps themselves) |
| Apps involved | HulkApps, Swym Wishlist Plus, Selleasy, Hextom, Qikify |
| Phishing domains | biliing.top, checkout-confirm.top, order-confirm.top |
| Status (Oct 15) | Active; 7+ affected merchants; phishing DNS records removed |
| Owner's main action | Remove unneeded apps + incognito checkout test + rotate passwords |
The bigger lesson: trust burns in one click
A customer who loses their card details on a fake page never comes back — and tells everyone they know. For an online store, checkout security is exactly as important as site speed and product quality: invisible until it breaks. The campaign also proved fast reaction is possible: after Shopify escalated internally, mechanicalkeyboards.com's hijack disappeared within 16 minutes of removing the HulkApps integration. You just have to know where to look.
Q: My store isn't on Shopify — what should I worry about?
The same pattern: third-party scripts. Any code not served from your own infrastructure (chat widgets, ads, analytics, WooCommerce plugins) can be compromised. Periodically review loaded scripts in DevTools (Network tab) and remove or question anything you don't recognize.
Q: How do I verify my checkout is real?
Test in an incognito window and check the URL, not the page design. Real Shopify checkout lives on checkout.shopify.com (or your own configured custom domain). A lookalike domain — like biliing instead of billing — is a red flag.
Q: A customer was hit. What now?
First disable the suspect app immediately so other customers are protected, then report to Shopify Support, then post a transparent notice on your site/socials: what happened, when, and what affected customers should do (contact their bank, block the card). Silence here is the most expensive decision.
Run your store, not your server
If you'd rather have someone who deals with speed, security hardening and SEO for your online store full-time, that's literally my job — see ecommerce website development in Tehran or just ping me on Telegram.