Topic starter
23/10/2026 12:45 am
TL;DR: An active campaign using fake Shopify stores advertised through Google Shopping to steal payment details, with over 2,000 stores observed and about 100 new ones appearing each week, was reported by Bfore. The blend of real storefronts, redirect malware, and live operator verification shows how fraud now bypasses both customer suspicion and conventional checkout controls.
Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “Fraudulent Shopify stores running ‘Outsider’-linked phishing kits”.
By the numbers:
- Bfore detected an active campaign running this playbook on over 2,000 Shopify stores.
- Roughly 100 new ones appearing each week were added to the campaign.
Key questions
Q: What breaks when a fake checkout page relays the victim’s own approval in real time?
A: The assumption that out-of-band verification proves the user is interacting with the real merchant breaks down.
Q: Why do shopping-ad phishing campaigns increase payment and account takeover risk?
A: They combine trusted discovery, real storefront branding, and checkout-stage redirection, which lowers suspicion before the victim enters sensitive data.
Q: How can security teams spot fraudulent storefront operations before loss escalates?
A: Look for recently registered stores, checkout assets that redirect off-platform, unusual confirmation-email behaviour, and traffic patterns tied to shopping ads rather than organic navigation.
Practitioner guidance
- Audit checkout redirection assets Inspect storefront theme files and content delivery paths for scripts that intercept checkout clicks or redirect to external payment hosts.
- Bind approvals to transaction context Require controls that tie OTPs, app approvals, and payment confirmations to the intended merchant, device, and session context instead of treating them as standalone trust signals.
- Monitor storefront tokens as privileged secrets Treat Shopify Admin API tokens and similar service credentials as high-risk secrets.
Bottom line: The campaign turns legitimate-looking storefronts and ad placements into a delivery system for checkout phishing and payment credential theft.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
23/10/2026 9:49 am
Checkout-path phishing is now a trust-boundary problem, not just a web phishing problem. When attackers can keep a real storefront in place and swap only the payment step, the control gap moves from email hygiene to transaction integrity. That changes how teams should think about fraud detection, merchant validation, and checkout hardening. Practitioners need to assume the storefront can be authentic while the payment path is not.
A few things that frame the scale:
- Tycoon 2FA alone accounted for 62% of phishing detected by Microsoft and over 64,000 confirmed incidents.
A question worth separating out:
Q: What should teams do when a merchant checkout flow is suspected of being compromised?
A: Contain the store by removing redirect assets, rotating any exposed admin or API credentials, and reviewing order-confirmation, refund, and payment logs for evidence of fraudulent transactions. Then assess whether the campaign also captured broader identity data such as SSNs or bank credentials, because the impact often extends beyond card theft.
👉 Read our full editorial: Fake Shopify checkout phishing campaign turns shopping ads into fraud