Two minutes, one incognito window

If you run a Shopify store, do this today. Open a new incognito window, add something to the cart, click checkout. Look at the address bar.

Since 10 October some stores had a fake checkout sitting in front of the real one. It came in through apps. They load extra JavaScript from their own servers, and someone put a redirect in there. Shoppers typed their card details on domains like checkout-confirm(.)top and then landed on the real checkout like nothing happened.

Apps named so far: Hulk Product Options, Selleasy, Swym Wishlist Plus. Roman Zipp, the developer who found it, keeps a running write-up here: https://romanzipp.com/blog/shopify-hit-with-phishing-attack

It fires only once per shopper, so use a fresh private window for every test.

8 years in Shopify and my rule is still the same. Every app you install is someone else's code on your checkout. If you have not opened an app in 3 months, uninstall it.

Black Friday is close. Better to clean up now than in November.