Security Alert: Swym Wishlist Plus Checkout Hijack — What Shopify Merchants Need to Know

If your Shopify store uses the Swym Wishlist Plus app, please read this and check your store.

What we know

On Tuesday, October 14, 2026, an unauthorized party changed the Swym Wishlist Plus app's configuration so that a script loaded on some Shopify storefronts. For roughly six hours (10:06 to 16:32 UTC, which is 6:06 AM to 12:32 PM Eastern), shoppers on affected stores who clicked Checkout may have been sent to a fake checkout page designed to collect credit card details before being passed through to the real checkout.

Swym says the script has been removed from all affected stores and the access path used in the attack has been closed. Swym has started emailing some merchants whose stores loaded the script. It has not posted a public statement, and most stores with the app installed have not been contacted. The app was removed from the Shopify App Store on the morning of October 16.

This is part of a wider wave of checkout-redirect attacks on Shopify apps this month. Hulk Product Options and Selleasy have reported similar incidents, and both have also been pulled from the App Store. Shopify's own checkout was not breached; the redirect happened on the storefront before checkout loaded.

What to do today

1. Open your store in a private/incognito window, add a product to the cart, and click Checkout. The address bar should stay on your own domain or your myshopify.com address. If it goes anywhere else, contact Shopify Support immediately. Repeat in a fresh window, because the script fires only once per session.
2. Pull orders from October 14 between 6:06 AM and 12:32 PM Eastern where a card number was typed in directly (not Shop Pay, PayPal, Apple Pay or Google Pay). Swym recommends advising those shoppers to contact their card issuer and monitor their statements.
3. Change your Shopify password and your Swym dashboard password, and turn on two-step authentication.
4. Talk to your attorney and your payment processor about whether you have notification obligations. Swym's notice says those are the merchant's responsibility.

Read more and form your own view

We are sharing what is public and what Swym told merchants directly. For the full picture, read the original reporting:

• Roman Zipp — Shopify shops hit with ongoing Checkout Hijack attack — the security researcher who first documented the campaign on October 10, with statements from HulkApps, Selleasy and Qikify in the comments
• iTnews — Shopify tells Australian store to stay shut after hijacked extensions divert shoppers — press coverage from October 16
• WitsCode — Shopify Phishing Attack: Fake Checkout Hijack and What to Check — a detailed timeline and merchant checklist
• Qikify — Updates on Security Incident — the July incident report from an app vendor hit by the same pattern
• Swym Wishlist Plus on the Shopify App Store — currently listed as not available
• Shopify Help Center — Two-step authentication

If you have questions or a shopper has reported being redirected, Swym asks merchants to contact support@getswym.com.

For Text Connects clients

We are checking every store we manage for the affected apps and running the checkout test on each. If you run Swym and you are not sure whether your store was affected, send us your store URL and we will run the check. We will update this post as more information is published.