Supply chain attack on Shopify apps sends shoppers to a fake checkout

In mid-October, shoppers on Shopify stores running Hulk Product Options, Selleasy and Swym Wishlist Plus were sent to a fake checkout. Developer Roman Zipp documented it on 10 October. The three vendors have confirmed that someone changed their app's settings.

Sansec found the same gang in four more apps: StarApps Color Swatch King, AVADA Air Reviews, Trustify Reviews and 17TRACK, on 71 stores in total. The publicly reported domains, such as biliing.top and checkout-confirm.top, and the server 45.197.2.217 serve the same checkout kit. We call the campaign Checkiout, after the misspelled __CHECKIOUT_CART__ marker in that kit.

The app prints the script into every page of the store. When a shopper clicks checkout, the script sends them to a copy of a Shopify checkout, where they enter their card. The current version then says the payment route is unavailable and sends the shopper to the real checkout to pay again. The store sees a normal order.

In September a merchant told us a customer had been sent to the fake checkout. They checked their theme, scripts, pixels, Tag Manager, apps and DNS and found nothing. The customer stopped because the payment page named an unrelated brand, Vitamin A Swim.

Four apps in five waves

These are the stores our crawler and urlscan recorded. Only the app vendors know the full count. The public HulkApps, Selleasy and Swym waves ran from 10 to 14 October.

Test runs in September

The attacker tried Air Reviews on one store on 1 September (poc104) and Trustify on two stores on 11 September (TFY125). In Air Reviews the script sat in the text of a discount banner. In Trustify it sat in the star icon setting. Both widgets wrote those values into the page as HTML.

AVADA Air Reviews, 9 October

Air Reviews prints its settings as JSON inside an inline <script> block and does not escape </. On 9 October the attacker added a key the dashboard does not offer, reviewCarouselWidget.carouselHeading. Its value closes the settings block and opens a new script. All 23 Air Reviews stores our crawler visited between 15:23 and 22:10 UTC had it. All were clean again by 03:03 the next morning.

Color Swatch King, 17 October

Color Swatch King prints each store's configuration into the page as window.vskData. Its custom_scripts field contains JavaScript that the app runs on every page. According to StarApps' help pages, its support team writes these scripts. Merchants have no editor for them.

On 17 October the attacker filled that field on 44 stores, including skate shoe brand etnies and boot maker Lucchese. The script went in between 19:00 and 19:17 UTC and was gone by 23:17. In the last minutes, five stores served a copy that redirected to 240.1.2.3, an address that goes nowhere. We don't know who made that change.

That night the app stopped loading on every store, and it was delisted from the App Store the next day. Color Swatch King has about 13,000 installs. By 30 October it loaded again with custom_scripts empty.

17TRACK, 20 October

Urlscan recorded a store whose menus had a new item linking to /apps/17TRACK, the page of the 17TRACK order tracking app. Its title was an HTML image tag with an onerror handler that loaded the kit from cartassure.top. The theme prints menu titles without escaping.

The merchant's staff and apps with navigation access can edit menus. The link suggests the attacker used 17TRACK's access to the store, but we have not confirmed that. 17TRACK was delisted from the App Store the same day.

The fake checkout

The kit has been in use since July 2026. It copies the checkout of swimwear brand Vitamin A and shows the shopper their own cart, passed in the redirect URL or in window.name. It asks for card number, expiry, CVV, name, address, phone and email.

Since 19 September the kit encrypts card data in the browser with AES-256-GCM, under a 3072-bit RSA key per server. A copy without card number and CVV goes along in plain text for the operators' dashboard. The server that receives the data never has the key to the card numbers.

A cookie blocks a second submission from the same browser for 72 hours. The current build then shows "The payment route is temporarily unavailable" and sends the shopper to the store's real checkout. Build stamps in the kit's asset URLs date each change:

The kit domains are .top names registered through NameSilo a day or two before use. They run on servers in Hong Kong, and the redirect pages declare Chinese as their language. Between 18 and 23 October the operators added at least 14 domains and a new server, 207.57.171.90. On 28 October cart-finalize.top still served the kit.

Write access to app settings

Selleasy says an attacker used one of its internal tools. Swym rotated credentials after an unauthorized configuration change. Qikify, hit in July, blames a leaked credential. StarApps, AVADA and Trustify have published nothing we could find.

Our data also points at the vendor side. In both large waves, dozens of unrelated stores changed within minutes. The attacker wrote fields and keys that merchants cannot edit.

What merchants should do

If your store runs Color Swatch King, review checkouts started on 17 October between 19:00 and 23:20 UTC. Check that custom_scripts in window.vskData contains only scripts you asked StarApps for. For Air Reviews, review 9 October up to 03:00 UTC on 10 October. For 17TRACK, delete navigation menu items that link to /apps/17TRACK or have HTML in their title.

Shoppers who saw Vitamin A Swim on another store's checkout, or the "payment route" message right after entering their card, should ask their bank for a new card.

What app developers should do

Escape < as < in any JSON you print inside a <script> block. Write merchant settings into the page with textContent, never innerHTML. Log every settings write with the account that made it, and alert on values that contain <script, onerror= or atob(.

Indicators of compromise

# Fake checkout and redirect domains
trendpay.top            registered 2026-07-18
paytrend.top            registered 2026-07-18
808pay88.top            registered 2026-07-24
jqek9c.bond             kit seen 2026-07-26
shopfily.shop           kit seen 2026-07-26
sdrgfd.com              registered 2026-07-30
jkusfg.top              registered 2026-08-01
bu008feng.my            shares TLS certificates with 808pay88.top and jkusfg.top
y5d4.my                 kit seen 2026-08-31
6bn.my                  kit seen 2026-09-10
secure-cart.top         registered 2026-09-13
biliing.top             registered 2026-09-13
order-confirm.top       seen 2026-09-16
cart-finalize.top       registered 2026-09-19, serving the kit on 2026-10-28
checkout-confirm.top    registered 2026-10-09
billing-confirm.top     registered 2026-10-13
account-confirm.top     registered 2026-10-14
checkout-secure.top     registered 2026-10-14
checkout-verify.top     registered 2026-10-15
checkout-protected.top  registered 2026-10-15
invoice-confirm.top     registered 2026-10-15
checkout-guard.top      registered 2026-10-18
checkout-auth.top       seen 2026-10-18
purchase-confirm.top    seen 2026-10-18
checkoutguard.top       registered 2026-10-19
checkout-assure.top     seen 2026-10-19
cartassure.top          registered 2026-10-20, 17TRACK menu wave
settlehub.top           seen 2026-10-20
cartguard.top           seen 2026-10-20
checkcart.top           seen 2026-10-22
nodecart.top            seen 2026-10-22
shopcheck.top           seen 2026-10-22
checkoutauth.top        seen 2026-10-23
checkoutassure.top      seen 2026-10-23
admincart.top           registered 2026-10-23

# Servers
45.197.2.162      AS54801 Zillion Network
45.197.2.217      AS54801 Zillion Network
45.207.226.201    AS54801 Zillion Network
207.57.171.90     AS54801 Zillion Network, from 2026-10-20
128.241.233.95    AS213802 TF Tianfeng
202.95.9.33       AS152194 CTG
202.95.9.35       AS152194 CTG

# Markers in the injected script
__CHECKIOUT_CART__:                      window.name prefix read by the kit
__CHECKIOUT_FASTBUNDLE_RUNTIME__         Color Swatch King
reviewCarouselWidget.carouselHeading     Air Reviews settings key
ARX263:
__arx_handoff_done_v1
__POC104_AIR__
__TFYPO125
poc125_canary
anncode-validation-20260724-jandm-v1
/apps/17TRACK                            menu link with HTML in its title
/check-out/assets/l2.js
/check-out/assets/l3.js
__ctf_shim_handoff_done_v1               sessionStorage key
__ctf_checkout_txn_v1                    sessionStorage key

# Fake checkout
vitaminaswim-clone                       address autocomplete source ID
co_submit_lock_                          cookie, 72 hours
/api/submissions                         upload path on the kit host
sha256:14b43e8119f1285408fd2e330e85455c811c98cbce6070adad1ca642c4544d4c   RSA key ID
sha256:bf45ec51c3c27c26153c869e45435fb352ba3d372428d320e6e9a2604781e0c6   RSA key ID

Timeline

Read more

• Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
• Magecart skimmer turns Stripe into a malware command server
• GorgonAgora: 4,800+ fake storefronts skim cards across hundreds of impersonated brands
• SVG Onload Tag Hides Magecart Skimmer on 99 Stores
• Novel WebRTC skimmer bypasses security controls at $100+ billion car maker