Inside the HulkApps Shopify Checkout Hijack
Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page on biliingtop that captured their card details before forwarding them to the real Shopify checkout.