Hijacked Shopify Apps Redirect Shoppers to Fake Checkout

An Australian Shopify store was advised to stay closed after a third‑party app/theme extension injected malicious code that redirected shoppers to a fake checkout page. Two app vendors (Logbase and HulkApps) reported unauthorized access or configuration changes that inserted scripts designed to intercept checkout clicks and send customers to lookalike payment domains, risking stolen payment or personal details.

Key findings

• A shopper was redirected from a legitimate Shopify store to a “bogus checkout” after malicious code was delivered via third-party theme extensions/apps.
• Logbase said an “unauthorised party gained access” to an internal tool and “add[ed] a malicious script” into Selleasy settings affecting multiple stores.
• HulkApps disclosed a similar compromise where code (including a function named “hijack”) intercepted clicks on the checkout button and redirected to lookalike payment domains (e.g., biliing[.]top, checkout-confirm[.]top).
• The script behavior was designed to be stealthy: it could be blocked by some browsers and was “designed to fire only once per browser session” before allowing the real checkout.

Who’s being targeted

• Commonly targeted roles: E-commerce Operations, Web/Shopify Administrators, Customer Support, Fraud/Payments Team, Security/IT.
• Affected industries: E-commerce retail, Online consumer goods.
• Attack channels: website.
• Impersonated: Lookalike payment/checkout page mimicking the merchant’s checkout, Legitimate Shopify app/theme extension configuration (abused to deliver malicious JavaScript).

Awareness takeaways

• Train support and e-commerce teams to treat customer reports of checkout URL changes as an emergency and to capture evidence (screenshots/URLs).
• Include third-party apps/extensions in incident response planning; a compromise can affect many stores even if your own systems weren’t directly breached.
• Teach teams to verify the checkout/payment domain and to watch for lookalike domains as a sign of fraud or data theft.
• Communicate that attacks may be intermittent and hard to reproduce; absence of repeat redirects does not mean the threat is gone.

Red flags to watch for

• Checkout domain changes to an unfamiliar lookalike domain (e.g., biliing[.]top, checkout-confirm[.]top)
• Redirect occurs immediately after clicking the checkout button
• Only happens intermittently (e.g., once per session), making it harder to reproduce and diagnose
• Unexpected JavaScript present in app/theme extension settings
• Vendor reports unauthorized access to internal tooling/configurations
• Shoppers report suspicious checkout URLs or pages