In October 2026, shoppers on several Shopify stores clicked “Checkout”, entered their card details, and received a standard order confirmation. Nothing looked out of place. Yet their card data had already been copied by an attacker’s look-alike page.
The stores themselves were not hacked. Shopify was not hacked. Instead, the attacker broke in through apps the merchants had installed. That is the new reality of e-commerce security in the AI era: your weakest link is rarely a single store password, but the long chain of tools, vendors, and automations connected to your admin.
This article covers the threats that are documented and sourced. Where nobody has published a number, we say so.
- The most critical incident of 2026 was a supply-chain attack. Malicious code was stored in app vendors' settings systems and served to stores through apps such as Hulk Product Options, Selleasy and Swym Wishlist Plus.
- AI makes old scams cheaper, not different. Phishing, fake stores, and card testing existed long before 2026; AI simply lets attackers launch them with greater speed, polish, and scale.
- The most exposed asset is often an API token, not a password. Admin API keys pasted into code, AI coding assistants and configuration files keep leaking.
- Shopify reacted at the platform level. On October 20, 2026, Shopify added a warning before storefronts send shoppers to an outside site; on October 23 it narrowed this to blocking known-malicious sites and confirming suspicious ones.
Concept illustration: a Shopify storefront whose checkout path is quietly diverted through a compromised app.
Real-world observation: the public report that first described the checkout hijack (romanzipp.com, October 10, 2026).
Part of the Topic HubExplore the Shopify Security Spotlight Hub →
1. The October 2026 app hijack: what actually happened
On October 10, 2026, developer Roman Zipp noticed that the checkout button on a keyboard store sent him to an unfamiliar domain. He traced the redirect directly to the Hulk Product Options app. The alarming detail was how the attack functioned:
- The app’s core JavaScript file on
cdn.shopify.comwas unchanged. - That clean script fetched the store’s app settings from the vendor’s own API.
- One settings field stored “custom” JavaScript. The attacker had placed roughly 22.7 KB of rogue code there.
- That code intercepted the checkout click, displayed a fake checkout form, harvested the card data, and then forwarded the shopper to the real Shopify checkout so the transaction still went through.
Over the following days, the developer of Selleasy confirmed an attacker had accessed an internal tool and added scripts to some stores’ settings, and Swym Wishlist Plus was also reported. By October 16, all three listings were unavailable in the App Store. An Australian merchant told iTnews that Shopify asked them to keep the store closed while the issue was investigated; it reopened by October 19.
No one has published how many stores or shoppers were affected. Shopify’s public statement stressed that apps must meet its security standards and that merchants stay in control of which apps they install.
Diagram: the attack never modified the store’s theme or Shopify’s CDN. It lived in the vendor’s settings data.
Why it matters for every merchant: Your store executes code from every app you install, and many apps load settings dynamically from their own infrastructure at runtime. If a vendor’s back office is breached, every store using that vendor can be affected at once—without the merchant altering a single line of theme code.
2. AI-assisted phishing aimed at merchants and staff
Phishing remains the fastest route into a store admin. What changed is the quality. Security-awareness vendor Hoxhunt reported that the share of user-reported phishing emails showing signs of AI assistance jumped sharply between November 2025 and January 2026 (vendor data, sample size not disclosed). Natural language generation has replaced awkward grammar and telltale spelling mistakes with convincing, brand-aligned messaging.
Typical merchant-targeted lures include fake “store suspended” or “payout on hold” notices, fake app-review requests, and fake partner or developer invitations asking for collaborator access.
The platform has been abused too. In June 2026, BleepingComputer reported fake receipts impersonating Norton, McAfee, Apple and PayPal appearing in users’ Shop app order history, each pushing a phone number to call. Shopify said it rolled out new controls that significantly reduced the activity.
What helps: Require passkeys or security keys for every staff account, and establish a firm rule that nobody approves collaborator or app access from an email link.
3. Cloned storefronts built from your catalog
Your product photos and descriptions are public, and AI tools make it easy to rebuild a convincing store around them. Sansec documented a network called GorgonAgora: by June 3, 2026, 5,714 confirmed fake storefronts copying catalogs scraped from real Shopify stores of brands such as Starbucks, Lego and Nike. The fakes ran on Medusa.js, not Shopify, showed a fake Stripe card form, and relayed the 3D Secure step so the purchase felt legitimate.
Real-world observation: Sansec’s report on fake stores cloning scraped Shopify catalogs (June 2026).
The damage lands directly on the real brand: chargebacks you did not cause, support tickets for orders you never received, and customers who lose trust in your business.
4. Bots, now including AI agents
The Imperva (Thales) Bad Bot Report 2026 says bots made up more than half of all web traffic in 2025, and it now tracks AI agents as a separate category. For a Shopify store, this automated activity typically shows up as:
- Card testing: bots trying stolen card numbers with small orders.
- Inventory hoarding during limited drops.
- Catalog scraping, which feeds cloned stores like the ones above.
Some of this traffic is legitimate: AI shopping assistants that browse and buy on a customer’s behalf are part of Shopify’s agentic commerce plans. The hard problem in 2026 is telling a useful agent from an abusive bot.
5. Leaked tokens and AI coding tools
Many stores rely on custom apps, private integrations, or external agencies with Admin API tokens. GitGuardian’s State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% rise, and found 24,008 secrets inside MCP configuration files used to connect AI assistants to tools.
The lesson for merchants is straightforward: a store’s Admin API token is as powerful as a staff login, and it is easier to leak. It ends up in a repository, a shared doc, or an AI chat.
6. What the numbers say about scale
The FBI’s Internet Crime Complaint Center reported about $20.9 billion in losses from more than a million complaints in 2025. More than 22,000 complaints referenced AI, with about $893 million in losses. IC3 warned that AI-generated content is increasingly difficult to detect. These are not Shopify-specific numbers, but they show the direction.
7. Trade-offs: what not to over-react to
- Do not uninstall every app. Apps are not the enemy; unmaintained and over-privileged apps are.
- Do not block all bots. Search engines and legitimate AI shopping agents need to reach your catalog.
- Do not rely on one tool. No single scanner would have caught the October attack, because the malicious code was delivered as data from a trusted vendor.
8. A 5-step checklist for this week
- List your apps in Settings → Apps and sales channels. Remove anything unused, and look up any app you do not recognise.
- Open your store in a private window and click through to checkout. The address bar should stay on your domain or Shopify’s checkout.
- Turn on passkeys or security keys for every staff account, and remove staff and collaborators who no longer need access.
- Rotate any Admin API tokens that have ever been pasted into code, documents or AI chats.
- Watch for Shopify’s new redirect warning when testing your own store. If it appears on a link you did not create, investigate.
Next in this series: what Shopify itself has built to protect stores, the security technologies worth understanding, and how Navi+ is designed to limit risk.
Sources
- Roman Zipp, Shopify shops hit with ongoing Checkout Hijack attack (Oct 10, 2026, updated Oct 22): https://romanzipp.com/blog/shopify-hit-with-phishing-attack
- cside, HulkApps Shopify checkout hijack: https://cside.com/blog/hulkapps-shopify-checkout-hijack
- iTnews, Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (Oct 16, 2026): https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693
- Shopify Changelog, New protection against unexpected redirects (Oct 20, 2026): https://changelog.shopify.com/posts/new-protection-against-unexpected-redirects
- BleepingComputer, Order tracking app Shop abused to push callback phishing attacks (Jun 25, 2026): https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/
- Sansec, GorgonAgora fake storefront skimming network (Jun 2026): https://sansec.io/research/gorgonagora-fake-storefront-skimming-network
- Imperva, Bad Bot Report 2026: https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/
- Hoxhunt, Phishing trends report: https://hoxhunt.com/guide/phishing-trends-report
- GitGuardian, State of Secrets Sprawl 2026: https://dev.to/gitguardian/the-state-of-secrets-sprawl-2026-ai-service-leaks-surge-81-and-29m-secrets-hit-public-github-2bgj
- CyberScoop, FBI IC3 annual cybercrime report (Apr 2026): https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/