Shopify Stores Compromised by Malicious Code Redirecting Customers to Phishing Sites

romanzipp.com

Shopify Stores Compromised by Malicious Code Redirecting Customers to Phishing Sites

First seen 16 Oct 2026, 13:38 UTC • •57.8

Article Content

1 / 3

Browse articles

ThreatCluster •October 16, 2026 at 13:39 UTC

•Multiple Shopify stores were compromised, redirecting customers to phishing sites.
•Malicious code was injected through third-party apps like Selleasy and HulkApps.
•Shopify has advised affected stores to remain closed during ongoing investigations.

On October 13, 2026, several Shopify stores, including WAGD, were affected by a phishing attack that redirected customers to fake checkout pages. The attack was executed through malicious JavaScript code injected into third-party apps, notably Selleasy, by an unauthorized party accessing internal tools. Affected app developers, including Logbase and HulkApps, confirmed the compromise but stated that they found no evidence of a breach of their systems. Shopify has advised WAGD to remain closed while investigations continue, leaving the store owner uncertain about reopening and financial losses. As of October 16, all affected apps have been fixed or removed from the App Store. The origin of the malicious code remains unclear, and customers may have unknowingly provided their payment information on the fake sites.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 2h ago How this analysis works

Timeline

2026-10-13

Phishing attack executed

Malicious code was injected into Shopify apps, redirecting customers to fake checkout pages.

2026-10-16

Affected apps fixed or removed

All compromised apps, including Selleasy and HulkApps, have been addressed or delisted from the App Store.

More articles in this cluster (2)

Threat Graph

9 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Phishing
T1059.007 - JavaScript

Organization (5)

HulkApps
Logbase
Selleasy
Shopify
WAGD

Indicator (1)

checkout-confirm.top

Relationships

Malware related to Phishing
Malware related to HulkApps
Malware related to Logbase
Malware related to Selleasy
Malware related to Shopify
Malware related to WAGD
Malware related to checkout-confirm.top
Malware related to T1059.007 - JavaScript

Following this threat?

Track HulkApps in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which apps are affected?

The affected apps include Selleasy, HulkApps, and Swym Wishlist Plus.

Is customer data at risk?

There is a possibility that customers may have entered their payment information on the fake checkout pages.

What should store owners do?

Store owners should disable affected apps, change passwords, and monitor for any suspicious activity.

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…