Google Shopping phishing on Shopify: what should defenders watch?

TL;DR: An active campaign using fake Shopify stores advertised through Google Shopping to steal payment details, with over 2,000 stores observed and about 100 new ones appearing each week, was reported by Bfore. The blend of real storefronts, redirect malware, and live operator verification shows how fraud now bypasses both customer suspicion and conventional checkout controls.

Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “Fraudulent Shopify stores running ‘Outsider’-linked phishing kits”.

By the numbers:

• Bfore detected an active campaign running this playbook on over 2,000 Shopify stores.
• Roughly 100 new ones appearing each week were added to the campaign.

Key questions

Q: What breaks when a fake checkout page relays the victim’s own approval in real time?

A: The assumption that out-of-band verification proves the user is interacting with the real merchant breaks down.

Q: Why do shopping-ad phishing campaigns increase payment and account takeover risk?

A: They combine trusted discovery, real storefront branding, and checkout-stage redirection, which lowers suspicion before the victim enters sensitive data.

Q: How can security teams spot fraudulent storefront operations before loss escalates?

A: Look for recently registered stores, checkout assets that redirect off-platform, unusual confirmation-email behaviour, and traffic patterns tied to shopping ads rather than organic navigation.

Practitioner guidance

• Audit checkout redirection assets Inspect storefront theme files and content delivery paths for scripts that intercept checkout clicks or redirect to external payment hosts.
• Bind approvals to transaction context Require controls that tie OTPs, app approvals, and payment confirmations to the intended merchant, device, and session context instead of treating them as standalone trust signals.
• Monitor storefront tokens as privileged secrets Treat Shopify Admin API tokens and similar service credentials as high-risk secrets.

Bottom line: The campaign turns legitimate-looking storefronts and ad placements into a delivery system for checkout phishing and payment credential theft.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →