If you run Swym Wishlist Plus on your Shopify store, you may have noticed something new this week: the app’s Shopify App Store listing now says it is not currently available, and directs merchants to contact Swym directly for support.
Here is what we know, what you should check today, and how to keep your wishlist working without missing a beat.
What happened
In early October 2026, security researcher Roman Zipp published a detailed write-up of a checkout-hijack campaign hitting Shopify stores. Shoppers who clicked “Checkout” were quietly redirected to a fake checkout page built to collect card and personal details, then sent back to the real checkout so nothing looked wrong.
The malicious code was not coming from Shopify itself. According to the report, it was delivered through third-party app infrastructure. The first app identified was HulkApps’ Product Options, and later updates named other apps as well, including Swym Wishlist Plus (reported by a developer on LinkedIn), Selleasy, and Hextom.
A few things worth being clear about:
- Shopify has not publicly stated why the Swym listing is unavailable.
- Public analysis of Swym’s storefront script suggests Swym shipped a fix around October 14 that escapes and sanitizes wishlist button text, which is where the attack was reported.
- The full scope of the campaign, and how the code got into each app’s systems, is still unclear.
So this is not a reason to panic. It is a reason to check your store today.
How to check if your store was affected
It takes two minutes:
- Open your store in a private / incognito window.
- Add any product to the cart and press Checkout.
- Look at the address bar. You should land on your real Shopify checkout (your domain or
checkout.shopify.com), not an unfamiliar domain. The domains reported in this campaign includebiliing[.]top,checkout-confirm[.]topandorder-confirm[.]top.
If anything looks off:
- Contact Shopify support right away.
- Disable any apps named in the reports until you have confirmation from the developer.
- Change your Shopify password and the password for each app’s separate dashboard account, and turn on two-factor authentication.
Keep your wishlist running with Notify Me!
If Swym was powering your wishlist, you do not have to choose between switching off the feature and waiting for an update. Notify Me! includes a full wishlist, and it is available on the Shopify App Store today.
It also does more than save a heart icon:
- Wishlist: Shoppers save the products they love, and you see exactly what they want.
- Back in Stock alerts: When a wishlisted item sells out, shoppers can sign up to be notified the moment it is back, by email, SMS or push.
- Pre-orders: Keep selling items that have not launched or are between restocks.
One app instead of three means fewer scripts on your storefront and fewer third-party accounts to secure.
More than 35,000 stores use Notify Me!, and it holds a 4.9★ rating from 3,500+ reviews on the Shopify App Store. Setup takes a few minutes, and our support team can help you move your wishlist over.
The bottom line
App incidents like this are a good reminder to audit what is running on your storefront. Check your checkout today, remove apps you no longer use, and pick tools that earn their place on your store.
If you want a wishlist that also brings shoppers back to buy, give Notify Me! a try.
