Shopify tells Australian store to stay shut after hijacked extensions divert shoppers

An Australian online retailer remains closed on Shopify’s advice, days after malicious code delivered through third-party theme extensions redirected at least one of its shoppers to a fake checkout page.

WAGD, which sells dog harnesses online, was hit on October 13, and app developer Logbase has confirmed that the store was among those affected by the attack.

Owner Carly Clarke told iTnews that a WAGD customer was sent to a bogus checkout, which is how she came to learn about the attack.

"I was lucky, the first I heard was from a suspicious customer," Clarke said.

"She just happened to work in tech and screenshot it all and sent me the URL.

"I closed the site immediately and reported to Shopify," Clarke added.

In a message seen by iTnews, a Shopify support representative said the matter was still under investigation and asked her to “please keep the password protection on while we wait for that confirmation”.

“Despite the app developer confirming that the malicious code has been removed and Shopify has verified its removal, I’m still being advised by Shopify not to trade and have received no clear timeframe for reopening,” Clarke said.

The message gave no timing for when Clarke could reopen the store.

“I’ve received more information from individual app developers than from Shopify itself,” Clarke said.

Clarke said she has not yet calculated the losses incurred.

How the attack worked

Logbase makes the Selleasy upsell app and blamed an unknown actor who had broken into one of its internal tools.

“An unauthorised party gained access to an internal Selleasy tool,” Saravanakumar C P, founder of Logbase, said in a notice to merchants.

“They used it to add a malicious script to the Selleasy settings of a number of stores.”

The attack ran between 07:47 and 15:00 UTC on October 13, which is 6.47pm to 2am the following day in eastern Australia.

Logbase said Shopify confirmed by email at 15:40 UTC that all malicious code delivered through Selleasy had been removed.

The company has since locked the setting the attacker abused and tightened authentication on its internal tools.

It has hired a third-party security firm, whose incident report will go to Shopify.

Logbase told iTnews it had found no evidence of a breach of Selleasy’s own systems, but could not rule out shoppers handing over their details.

“It is possible that some customers may have entered their information on that page; however, as it is outside our systems, we have no knowledge of what information, if any, was provided,” a Logbase spokesperson said.

Logbase did not say how many stores were affected.

It claims more than 49,000 active stores use Selleasy, and the app is currently listed as unavailable on the Shopify App Store.

HulkApps, which makes the Hulk Product Options app, disclosed a similar compromise.

“As part of a global online attack, unauthorised configurations altered the Hulk Product Options theme extension,” HulkApps said in a LinkedIn post.

The company said Shopify temporarily disabled the extension while it removed the code, and that it has since tightened authentication and brought in outside investigators.

The HulkApps case was documented by developer Roman Zipp.

Zipp found the redirect code arrived through a custom JavaScript setting pulled from HulkApps’ servers.

The script contained a function named “hijack”, which intercepted the shopper’s click on the checkout button, cancelled it and sent the shopper to a lookalike payment page instead.

The lookalike pages sat on domains including biliing[.]top and checkout-confirm[.]top, which Zipp said were not on common blocklists when he checked.

Logbase said the redirection did not succeed on every visit and was blocked by some browsers.

Zipp found the script was designed to fire only once per browser session, then let shoppers through to the genuine checkout.

iTnews contacted Shopify, which has an Australian office, for comment on the attack but didn't receive a response before publication.