Hijacked Shopify apps sent shoppers to fake checkout pages

Attackers abused at least two third-party Shopify apps in mid-October to redirect shoppers on merchants' stores to fake checkout pages, the apps' developers have confirmed, iTnews reported on Oct. 16.

The incident matters to small online retailers because the malicious code arrived through apps they had installed, not through their own accounts. Shopify, which is based in Ottawa, has not said its own checkout was breached; the fake pages ran on outside domains.

What happened

Logbase, maker of the Selleasy upsell app, said an unauthorized party "gained access to an internal Selleasy tool" and used it to add a malicious script to the settings of a number of stores between 07:47 and 15:00 UTC on Oct. 13. Logbase said Shopify confirmed that afternoon that all code delivered through Selleasy had been removed. The company, which claims more than 49,000 active stores, did not say how many were affected. It has locked the abused setting, tightened authentication on internal tools and hired an outside security firm.

HulkApps said its Hulk Product Options extension was altered through "unauthorised configurations" as part of what it called a "global online attack." Developer Roman Zipp found redirect code loaded from HulkApps' servers that intercepted clicks on the checkout button and sent shoppers to look-alike payment domains. He said it fired once per browser session, then let shoppers reach the real checkout, which made it harder to notice. Shopify temporarily disabled the extension.

Australian retailer WAGD stayed closed on Shopify's advice after a customer reported being sent to a bogus checkout; its owner said Oct. 19 that Shopify had told her she could reopen. A WitsCode write-up said a third app, Swym Wishlist Plus, was named in later reports and that all three were unavailable on the Shopify App Store on Oct. 16; that has not been independently confirmed.

What we don't know yet

The root cause across the apps, the number of stores affected and whether any card data was captured remain unclear. Shopify said apps must meet its "strict security and privacy standards" and that it can delist apps that fail them.

What to do

• Review installed apps and their permissions in your Shopify admin; remove any you do not use.
• Test your own checkout from a private browser window and confirm it stays on your domain or Shopify's.
• Watch for customer reports of unusual payment pages and act on them immediately.
• If you used an affected app, contact the developer and Shopify support, and consider notifying customers who checked out on Oct. 13.