- Malicious code delivered through two Shopify app vendors, Selleasy and HulkApps, sent at least one shopper to a fake checkout page, according to iTnews.
- Checkout pages depend on code from outside suppliers, so a supplier's weak admin tools become the store's risk.
- List the apps touching your checkout, ask which load vendor code, and agree who decides when you can trade again.
The owner learned from a customer
A shopper on the WAGD dog-harness store was sent to a fake checkout page. The shopper noticed, not the store's systems. Owner Carly Clarke told iTnews: "I was lucky, the first I heard was from a suspicious customer." The customer works in tech, took screenshots and sent Clarke the URL.
Clarke closed the site and reported the problem to Shopify. Days later the store is still shut. iTnews reports that a Shopify support representative asked her to keep password protection on while the matter is investigated, with no date to reopen.
Clarke says the app developer has confirmed the malicious code is gone and Shopify has verified its removal. She is still advised not to trade. "I've received more information from individual app developers than from Shopify itself," she said. She has not yet worked out her losses. iTnews says Shopify did not respond to its request for comment before publication.
The lesson here is simple. A modern online store is not one product. It is a shop assembled from other companies' code. The checkout button is where a shopper's trust turns into money, and some of the code beside it belongs to someone else.
How the attack worked
Logbase makes Selleasy, an upsell app. Its founder, Saravanakumar C P, told merchants that someone without permission had got into one of the company's internal Selleasy tools. From there, the intruder planted a harmful script in the Selleasy settings of some stores.
Logbase puts the activity between 07:47 and 15:00 UTC on October 13. In eastern Australia that ran from early evening into the small hours.
A second app vendor, HulkApps, reported a comparable incident affecting its Hulk Product Options app. It described "a global online attack" that altered its theme extension. Developer Roman Zipp documented that case. He traced the redirect to a custom JavaScript field that loaded code from HulkApps' own servers.
A function in the script was called "hijack". When a shopper pressed the checkout button, it stopped that action and took them to a copycat payment page. The copycat pages used web addresses such as biliing[.]top and checkout-confirm[.]top. When Zipp checked, common blocklists did not yet list them.
This shows where the weakness sat. The reports describe a way in through the app vendors, then a setting that stores trusted and loaded. The attacker did not need to break into each store one by one. A single supplier's tool reached several storefronts.
Why it was hard to spot
Zipp found the script fired only once per browser session. After that it let the shopper through to the genuine checkout. A staff member who clicked checkout twice would see the real page the second time.
Logbase also said the redirect did not work on every visit, and some browsers blocked it. That helps explain why the first alert came from a single attentive customer. It does not tell us how many others were redirected.
What is still unknown
Logbase gave no figure for affected stores. It said it found no evidence of a breach of Selleasy's own systems. It could not rule out shoppers entering their details on the fake page, and said it has no knowledge of what, if anything, was entered.
Logbase says it has closed off the setting the intruder used and added stronger login checks to its internal tools. An outside security firm is preparing an incident report for Shopify. The Shopify App Store currently shows Selleasy as unavailable. HulkApps says Shopify temporarily disabled its extension, and that it has brought in outside investigators.
Questions to put to your team
First, list every app and extension that touches your storefront and checkout. Ask which of them can load custom JavaScript from the vendor's servers.
Second, ask how you would find out. In this case a customer told the owner. Check whether anyone monitors for shoppers leaving your domain at the payment step.
Third, ask what each vendor must tell you, and how fast, if its own admin tools are compromised. Ask what authentication protects them.
Fourth, agree in advance who decides when you can trade again. WAGD's owner closed her store quickly. Reopening was then out of her hands.
Your checkout is only as trustworthy as the least-guarded tool at your busiest supplier.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: iTnews.
