If you run a Shopify store, the last two weeks have been confusing. Apps you rely on have vanished from the App Store, some have been switched off on stores, and the explanations are scattered across forum threads, vendor notices and LinkedIn posts. Plenty of merchants still don’t know whether their store was affected, whether an app they use is next, or what they should do about it.
This post pulls together what is actually confirmed, what you can check on your own store today, and how to think about replacing an app without walking into the same problem again.
What happened
Starting around October 10, 2026, some shoppers on Shopify stores clicked checkout and landed on a fake payment page instead of the real one. The page looked like Shopify’s checkout, collected card and billing details, and then sent the shopper on to the genuine checkout so nothing seemed wrong.
The code behind it ran through third-party apps already installed on those stores. In the case Roman Zipp documented in detail, the redirect came from custom JavaScript delivered through an app’s storefront extension and pointed shoppers to look-alike domains. The script used session storage to fire only once per shopper, so a second checkout attempt looked completely normal. That is a big part of why merchants struggled to reproduce it.
Several vendors have since published their own accounts. Selleasy reported injected scripts and external phishing redirects. HulkApps said an exploit introduced unauthorized configuration into its Product Options extension. Swym described an unauthorized configuration change that loaded a script on a subset of stores. Orichi reported an earlier incident in September involving malicious JavaScript in a campaign’s custom code. Setka keeps a running list that separates vendor-confirmed cases from allegations.
Why so many apps were delisted
Shopify removed a number of apps from the App Store while this played out, and a public tracker counted more than a hundred delistings, with a large batch on October 15. You’ll see bigger numbers quoted on social media.
Be careful with those numbers. A delisting is not proof that an app was compromised. Some removals line up with the security incidents, some appear to be policy or compliance reviews, and October 16 was also the cutoff for an older Shopify API version, which could explain others. As of this writing, Shopify has not published a statement tying the whole batch to one incident, and the root cause of the hijack itself is still not confirmed.
So “my app got delisted” and “my store was hacked” are two different questions. You need to answer both.
Check your store today
If you have, or recently had, any affected app installed, work through this list:
- Test checkout in a fresh private window, once per purchase route (product page, cart, any upsell or bundle flow). Because the hijack fired once per session, one clean test is not enough. Check the address bar on the payment step: it should be your store’s domain or Shopify’s checkout, never an unfamiliar domain.
- Check the vendor’s exposure window. Most vendor notices give dates and times. Compare them with when the app was active on your store. Having the app installed doesn’t prove you were hit, and not having a named app doesn’t prove you weren’t.
- Don’t assume uninstalling cleaned things up. Switching off an app embed or uninstalling the app does not guarantee that injected code or leftover theme snippets are gone. Look through your theme for code the app added and remove what you no longer need.
- If you see a redirect, act immediately. Restrict your Online Store access, contact Shopify Support and the app developer, and keep the customer’s report (never ask them to send card details). Remember that completed orders won’t show everyone who typed card details into a fake form and then gave up.
- Ask the developer direct questions. What changed, what was exposed, which stores and time windows were affected, and what evidence confirms the fix.
Choosing a replacement app without repeating the problem
Plenty of merchants now have to replace an app in a hurry. Some are simply deleting it and living without, others are building a quick replacement themselves, and many are comparing alternatives under pressure. Whichever route you take, this incident is a good reason to add a few questions to the usual checklist of features, support and price:
- How much code does it put on your storefront? Every app that loads JavaScript in front of shoppers is a path into your checkout flow. An app that does its work in the Shopify admin or through Shopify Functions has a much smaller footprint than one that injects scripts on every page.
- Can it run custom code you didn’t write? Features like “custom JS” fields are handy, but they are exactly what was abused here. If you don’t need it, prefer apps that don’t offer it, or at least make sure only trusted staff can edit it.
- Where does your data live? Apps that store their settings and content in Shopify, using metafields and metaobjects, are easier to inspect and easier to leave.
- Can you remove it cleanly? Ask what is left behind when you uninstall. Apps that edit theme files directly tend to leave code behind long after they’re gone.
- How did the vendor handle this month? A clear, timely incident notice with dates and specifics is a good sign. Silence is not.
- Is the pricing honest? Being forced to switch is a good moment to drop apps whose pricing punishes you for growing.
Fewer apps is often the best outcome. If a delisted app was doing something you barely used, this might be the push to leave it uninstalled.
Keep an eye on the code your store loads
The hard part of this attack was that it lived inside code merchants had already approved. Nothing in the Shopify admin looked different, and the shopper’s experience only looked wrong for a moment. Most stores have no record of which scripts their storefront loads, so they couldn’t tell when something changed.
That’s the gap Skyfense storefront script monitoring is built for. It visits your Shopify store like a shopper every hour, records the external scripts each page loads, and raises a finding with a code diff when one of them changes. Changed code is checked for payment-field keywords, obfuscation and data-exfiltration patterns, and critical findings go to your alert email or webhook. It’s in beta, it doesn’t inspect Shopify’s hosted checkout or remove code for you, and it compares against the scripts it first sees on your store, so the best time to start is before the next incident rather than after it.
Apps will keep coming and going. What you can control is how much code you let into your storefront and whether you’ll notice when it changes.