For about ten days this month, clicking the checkout button on some Shopify stores took shoppers somewhere else.
Between 10 and 20 October, attackers got into three popular apps: Hulk Product Options, Selleasy and Swym Wishlist Plus. They didn’t touch Shopify’s checkout, and they didn’t touch the merchants’ themes. They used the apps themselves. Code loaded through each app’s own settings, from the app developer’s servers, and when a shopper clicked checkout it quietly sent them to a look-alike payment page. Card details went to the attackers. Then the shopper was forwarded to the real checkout and the order went through as normal.
So the merchant saw a normal order. The theme files looked clean. And because the redirect only fired once per browsing session, testing the store a second time in the same tab showed nothing wrong.
What Shopify did
Credit where it’s due, Shopify moved quickly once it knew. It removed the injected code, switched off affected app features and pulled apps from the App Store while developers investigated. Swym switched its app off for every merchant. On 20 October Shopify told app developers it’s bringing in tighter limits on what app code can do on the storefront, along with stricter security requirements for the App Store. The dates for those haven’t been published yet.
That will help. It won’t change the basic fact that every app you install is someone else’s code running on your store, maintained by a company you’ve probably never spoken to.
Cut your exposure this afternoon
You don’t need an agency for this. You need an afternoon and your list of apps.
Start by going through every installed app and asking when it last did something you’d miss. If nobody can remember, uninstall it. Plenty of stores have a few apps that were trialled once, forgotten and are still loading on every page.
Then check what uninstalling left behind. A lot of apps leave snippets in your theme after they’ve gone. Open the theme editor, look at the app embeds that are switched on, and turn off anything you don’t recognise. We’ve written about the Shopify apps quietly slowing stores down, and the same clean-up helps both problems.
Next, list any app that lets you paste in custom JavaScript or HTML. That’s how this attack got in, so know which apps have that door and who in your team can open it.
Before you install anything new, check whether your theme or Shopify already does the job. A lot of the features stores install apps for, like bundles, wishlists or product options, have native or theme-level versions now. One less app is one less company with code on your checkout.
Tighten up your logins too. Turn on two-step authentication for every staff and collaborator account, and remove anyone who no longer needs access, including agencies you’ve stopped working with.
Test your checkout like a customer would
Every so often, open a private browser window, add something to the basket and click checkout. Make sure you land on your own domain or Shopify’s checkout, not something else. Close the window and do it again in a fresh one, because this attack only fired once per session.
If you ever do land somewhere unexpected, put the store behind a password, switch off the suspect app’s embed and contact Shopify Support and the app developer. Screenshot everything with the address bar visible first, then talk to your payment provider about what to tell customers.
Fewer apps, faster store
The happy side effect is speed. Every app you remove is a script that no longer loads, so the clean-up that makes your store safer usually makes it quicker too. And a quicker store converts more of the traffic you’re already paying for, which puts you in a better position for the busy weeks coming up.
How many apps on your store could you uninstall today without anyone noticing?
