Shopify third-party apps Selleasy (Logbase) and Hulk Product Options (HulkApps) hijacked 13 Oct: malicious checkout redirects; Australian retailer WAGD still password-locked on Shopify advice
iTnews reported on 16 October 2026 that WAGD, an Australian dog-harness retailer on Shopify, remains closed on Shopify's advice after malicious JavaScript delivered through third-party theme extensions redirected at least one shopper to a fake checkout on 13 October. Logbase, maker of the Selleasy upsell app (claimed 49,000+ active stores), said an unauthorised party accessed an internal Selleasy tool and added a malicious script to store settings; the attack window was 07:47–15:00 UTC on 13 October (evening into early morning AEST). Logbase said Shopify confirmed at 15:40 UTC that malicious code delivered through Selleasy had been removed, then locked the abused setting, tightened authentication and hired a third-party firm. Selleasy is currently listed as unavailable on the Shopify App Store. HulkApps separately disclosed that unauthorised configurations altered its Hulk Product Options theme extension in a global attack; developer Roman Zipp documented a function named hijack that cancelled the real checkout click and sent shoppers to lookalike payment domains including biliing[.]top and checkout-confirm[.]top, firing only once per browser session. Shopify temporarily disabled the HulkApps extension while the code was removed. Logbase said it has no evidence of a breach of its own systems but cannot rule out customers entering details on the fake pages. Shopify did not reply to iTnews before publication. Primary: iTnews (16 Oct 2026); vendor notices: Logbase and HulkApps.
- Product
- Shopify App Store third-party theme extensions — Selleasy (Logbase) and Hulk Product Options (HulkApps)
- Versions
- n/a — supply-chain compromise of app developer tooling / theme-extension settings (attack window 13 Oct 2026 UTC); Selleasy listed unavailable on App Store after incident
- Exploited in Australia?
- unknown
- Patch to
- Shopify merchants: review theme-extension and app custom JavaScript settings for unexpected scripts, remove or disable Selleasy / Hulk Product Options until the developers and Shopify confirm clean builds, and watch for lookalike checkout domains. Customers who checked out around 13 Oct: verify statements and consider card-issuer alerts. App developers: lock internal tools that can push store settings, require strong auth, and treat theme-extension JS as a high-value write path.