An Australian online retailer that sells dog harnesses had at least one customer redirected to a fake checkout page after malicious code was inserted into third-party theme extensions on its Shopify store, iTnews reported. The incident at WAGD occurred on 13 October.
Logbase, maker of the Selleasy upsell app, confirmed WAGD was among the stores affected. The company's founder, Saravanakumar C P, said in a merchant notice that an unauthorised party broke into an internal Selleasy tool and used it to insert malicious scripts across a number of stores' Selleasy settings.
A second app developer, HulkApps, disclosed a similar compromise of its Hulk Product Options theme extension, describing it as part of a global online attack in which unauthorised configurations altered the extension. Shopify temporarily disabled the HulkApps extension while the malicious code was removed.
WAGD owner Carly Clarke told iTnews she first learned of the attack from a customer who noticed something suspicious and sent her a screenshot along with the URL of the fake page. Clarke told iTnews she immediately closed the site and reported the matter to Shopify.
The script was built to trigger just once per browser session and then pass shoppers through to the real checkout. According to Logbase, some browsers blocked the redirect and it did not succeed on every visit.
At 15:40 UTC, Shopify sent an email confirming removal of all malicious code that had been delivered via Selleasy. Logbase puts Selleasy's active store count at more than 49,000, and the app was showing as unavailable on the Shopify App Store.
Logbase has since locked the setting exploited by the attacker and strengthened authentication on its internal tools, and has engaged a third-party security firm to produce an incident report for Shopify. HulkApps has since tightened authentication and engaged outside investigators.
A Shopify spokesperson told iTnews that all apps in its App Store must satisfy the platform's security and privacy standards, that Shopify takes action when an app falls short, up to and including delisting, and that in such cases the partner is asked to contact affected merchants directly. The same spokesperson told iTnews that merchants retain control over their installed apps and are able to check the activity and permissions of any app at any time. A Logbase spokesperson told iTnews that because the fake page was outside Logbase's own systems, the company has no knowledge of what information shoppers may have entered there.
Merchants using Shopify apps affected by this type of attack may find their stores placed under password protection by Shopify's direction while investigations are under way, with no guaranteed timeframe for trading to resume. Clarke told iTnews she had received greater detail from individual app developers than from Shopify, had been given no clear reopening timeframe, and had not yet tallied her losses.
Official statements: Logbase
Reporting: iTnews
Written by Pick & Scroll News from the reporting and documents linked above.
