Threat Pulse 62High
Shopify checkout hijack: HulkApps, Selleasy and Swym apps abused to redirect shoppers
Severity 5MitigatedconfirmedE-commerce and retail

Between October 10 and 14, attackers used compromised vendor access to add malicious scripts to three widely installed Shopify apps (Hulk Product Options, Selleasy, Swym Wishlist Plus), sending shoppers on affected stores to fake checkout pages. Shopify disabled extensions and vendors rotated credentials. Merchants should audit theme extensions and custom JS.

What to do: Scripts removed by October 14; forensic reviews pending; no card data confirmed stolen.

· 26 days ago · a limited subset of stores per vendors; three apps · Roman Zipp (vendor statements)
SourcesRoman Zipp (vendor statements)EthercycleLetsMetrix
Why this score

Thousands of storefronts (impact 2), live redirection of shoppers (exploitability 3), general sector (criticality 0).

Back to the board

Updated Nov 5, 01:46 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.