Trusted Shopify Apps Turned Into Phishing Funnels

Attackers turned trusted Shopify apps into phishing funnels this month, sending shoppers who pressed Checkout to a lookalike payment page that harvested their card details. Researchers at client-side security firm cside traced the campaign to configuration data that app vendors served from their own servers, not to the apps' code. The incident follows the Polymarket breach in June, when a compromised vendor script drained roughly $3 million from user wallets via the platform's legitimate website. Together, both attacks show that trusted third-party JavaScript has become one of the most dangerous and least monitored entry points on the modern web.

Developer Roman Zipp uncovered the scheme on October 10, 2026, while buying a keyboard from a popular Shopify store and clicking the Checkout button. His password manager offered to fill the first-name field with the name on his card, prompting him to check the address bar. Instead of the store's own domain, the browser showed biliing[.]top, a lookalike site that imitated Shopify's checkout page and requested payment and personal details. After capturing the card data, the fake page forwarded victims to the genuine checkout, so their orders were completed, and merchants saw nothing unusual.

The Hulk Product Options app from HulkApps loads a file called hulkcode.js from Shopify's own content delivery network, and attackers never modified that file. Instead, the file requested its settings from the HulkApps API, which returned a custom JavaScript field containing about 22.7 KB of malicious code. The app then injected that code into the storefront at runtime, where it appeared in browser developer tools as an anonymous script without a source file. A click listener with a function named hijack then canceled the real checkout navigation and sent each shopper to the attacker's lookalike domain instead.

The attackers designed the payload to evade the defenses that most merchants rely on, and several deliberate choices kept the campaign hidden for days. According to cside's analysis, the following tactics allowed the malicious script to slip past scanners, security policies, and even merchants testing their own stores. Each tactic exploited a gap between what automated tools observe and what real shoppers actually experience during a live checkout session.

• The script fired only when a real shopper clicked Checkout, so synthetic scanners that merely crawled store pages never triggered the malicious redirect.
• It set a session storage flag named __ctf_shim_handoff_done_v1 after one redirect, which made later retests by merchants and support staff look completely normal.
• The unchanged app file passed integrity checks, while the trusted Shopify CDN and vendor API already appeared on most stores' Content Security Policy allowlists.

More Vendors Caught in the Campaign

HulkApps was the first vendor linked to the campaign, but Swym Wishlist Plus and Logbase's Selleasy app delivered the same redirect through their own settings. Logbase stated that an unauthorized party reached an internal Selleasy tool and added a script to some stores' settings before Logbase removed it on October 13. HulkApps blamed an exploit that introduced unauthorized configurations, and Shopify temporarily disabled the app's theme extension while the vendor hired an outside security firm.

Qikify and Hextom suffered similar incidents in July and August 2026, and cside believes that someone is systematically targeting apps that turn configuration data into executable code. As of October 16, the App Store listed all three affected apps as unavailable, and Shopify has not published figures on the number of affected stores or shoppers.

The Shopify campaign mirrors an attack on prediction market Polymarket, which confirmed on June 25, 2026, that attackers had stolen roughly $3 million from users. In its statement, Polymarket said it "discovered a 3rd party vendor had been compromised," and that the vendor's script reached the frontend for some users.

When victims connected their wallets, the injected code displayed malicious token-approval requests via the genuine Polymarket interface, allowing attackers to sweep their pUSD balances. Polymarket's smart contracts worked exactly as designed, and the company removed the poisoned dependency and promised to reimburse every affected user in full.

Both incidents share a pattern that cside has highlighted repeatedly, since neither attacker broke into the target's own servers or core payment infrastructure. Instead, each attacker abused a third party that the site already trusted, and the malicious code reached users through the legitimate interface they recognized. The Content Security Policy also failed in both cases because it validates where a script originates rather than what that script actually does in the browser.

Many merchants assume that Shopify's status as a PCI DSS Level 1 service provider makes their own stores compliant, but cside argues otherwise. Shopify's certification covers its own infrastructure and card handling, while merchants still own the app scripts, Pixels, and widgets that load in shoppers' browsers. PCI DSS 4.0.1 addresses the browser layer through Requirements 6.4.3 and 11.6.1, both of which became mandatory for organizations on March 31, 2025. Requirement 6.4.3 requires merchants to inventory, justify, and authorize every payment page script, while 11.6.1 requires a mechanism to detect unauthorized page tampering.

In January 2025, the PCI Security Standards Council removed both requirements from Self-Assessment Questionnaire A, the shortest form available to merchants that outsource card handling. The council added a new eligibility criterion requiring merchants to “confirm their site is not susceptible to attacks from scripts” affecting their e-commerce systems.

The council also stressed that the changes leave the underlying requirements intact, as they remain part of the full PCI DSS standard. According to cside, most Shopify stores running loyalty apps, chat widgets, or analytics tags at checkout cannot cleanly confirm eligibility criteria today. The HulkApps campaign illustrates the risk, because a storefront script that silently swaps a real checkout for a fake one represents exactly such an attack.

The cside team recommends that every Shopify merchant running third-party apps check their stores, even if they never installed a HulkApps product. The firm outlined several practical steps that merchants can take immediately to detect the hijack and limit the damage to their customers. These steps also reduce exposure to future client-side supply chain attacks that abuse trusted vendors and their configuration systems in the same way. Merchants can also run a free check with the PCRisk Website Scanner, as described below.

• Merchants should test checkout repeatedly in fresh private browser windows on desktop and mobile, confirming that the address bar always shows their own domain
• They should open browser developer tools after each test and search session storage for any keys beginning with _ctf, which signal a confirmed infection.
• Store owners should review every app setting that allows custom JavaScript or HTML, and uninstall any app embeds they no longer need.
• If they find the redirect, merchants should preserve screenshots and HAR files, disable the app, and notify the vendor, Shopify Support, and their payment processor.

Manual checkout tests are the only reliable way to spot this specific redirect, but they won't reveal everything a compromised store can expose shoppers to. Merchants should also run regular checks with the free PCRisk Website Scanner, which flags malicious content, suspicious redirects, and blacklisting issues that can quietly damage a store's reputation. Combining routine scans with hands-on checkout testing gives store owners a much better chance of catching third-party tampering before their customers do.

Incidents like this one make shoppers more cautious about where they enter their card details. Shopify merchants who keep their stores clean can reassure visitors by installing the PCRisk Trust Badge, which shows customers that the store is regularly checked for malware and security threats. A visible trust signal can help reduce checkout hesitation and reward merchants who take client-side security seriously.