Urgent: Shopify Flagged “Malicious Code” Injected via Collaborator Account. Need Help Understanding Root Cause

Technical Q&A
1

We are facing a very serious issue with multiple Shopify stores and need guidance from the community if anyone has experienced something similar.

We received an email from Shopify stating that “malicious code” was inserted into the theme files of a client store. Shopify specifically mentioned these files:

  • layout/theme.liquid

  • assets/custom.css

  • assets/base.css

The email also stated that the code had the capability to capture data from buyers using cryptocurrency wallets during checkout.

According to Shopify’s investigation, the activity was linked to a collaborator account under the organization name “Our Organization Name” (our partner organization account). However, we did NOT intentionally add any malicious code, crypto wallet scripts, skimmers, or anything related to data capture.

Here is the main issue we are struggling with:

  1. Shopify claims the malicious code was inserted through our collaborator access.

  2. Shopify says they already removed the code.

  3. When we asked Shopify Support to show:

    • the exact code,

    • affected snippets,

    • logs,

    • timestamps,

    • or any technical details,

    they refused to provide anything due to their internal policy/security reasons.

  4. Because we cannot see what code triggered this action, we are unable to:

    • investigate properly,

    • identify the root cause,

    • audit our systems,

    • or prevent it from happening again.

  5. Now the SAME issue has started appearing on other client stores as well, and clients are losing trust and terminating contracts.

At this point we are extremely concerned because:

  • We do not know whether:

    • a collaborator account was actually compromised,

    • a third-party system/session was hijacked,

    • some script was falsely flagged,

    • or a dependency/app/snippet triggered Shopify’s detection system.

  • We have no visibility into what Shopify detected as malicious.

We are requesting help from the Shopify community:

  • Has anyone experienced a similar issue recently?

  • Has Shopify flagged theme code related to crypto wallets or checkout scripts before?

  • Is there any way to retrieve historical theme diffs/logs after Shopify removes code?

  • Are there recommended security audit steps for collaborator accounts and agency environments?

  • Could browser extensions, compromised devices, leaked session cookies, or Git/theme deployment workflows cause this?

  • Is there any way to escalate this with Shopify to get more technical details?

We have already:

  • Changed passwords

  • Reviewed collaborator access

  • Enabled/reviewed 2FA

  • Checked installed apps

  • Audited recent theme changes as much as possible

But without knowing what exact code was removed, it is becoming nearly impossible to defend ourselves or reassure clients.

Any technical guidance, similar experiences, or suggestions would be genuinely appreciated. This situation is seriously affecting our business and client relationships.

Thank you.

2

Hey @indybytesom

First of all the email itself looks suspicious. Have you confirmed that the email which you received was actually from Shopify? Usually, scammers also send these types of emails as well.

From which email did you receive the mail from? Can you share that?

Best,
Moeed

3

It is not clear what kind of services you provide, what kind of access you have to clients’ stores and what kind of technology you push there.

It may happen that some JS library you include in your builds is compromised and you push this code to your customers stores without knowledge.

Ideally, talk to your bigger, preferably Plus clients to involve their success managers to get more detailed info you need.

May be even better to reach out to your so far “unaffected” customers as a preventative measure (and a chance to catch that elusive “removed code”).

Do not wait for them to get the message from Shopify – be proactive and this may save your contracts.

Also -- malicious code in CSS files?
4

Hi @Moeed,

The email is belong to shopify, coz I contacted to support and support confirmed that they removed the malicious code and removed our organization.
Kindly check the screenshot.

476e68fe-6b66-4b13-85ca-4f10241c5560
476e68fe-6b66-4b13-85ca-4f10241c5560513×779 48.5 KB

5

@tim_tairli @Moeed
I’m a employee of a IT company and where I’m working as a Shopify Developer, basically we provide the IT services like build shopify stores from ground zero to up, maintain the stores and any kindly of customization.

So the time span mentioned (16 April - 23 April 2026) (Late night as mentioned in the screenshot) by the shopify support, we usually do NOT work and did not added any suspicious code which will be consider as malicious code.
And Shopify blocked our Shopify organization as well.

We have access of our client’s store in the single organization of our partner account.
As the shopify mentioned that there is something in my partner account which is injecting some ‘malicious code’ one by one in the client’s store.

6

So you likely have full access to your clients stores.

Technically, yes, something in Browser, like extension can access Shopify Admin and do all kind of things.

If your computer is not turned off during the night, it can happen without your knowledge.

Not sure what can be done here – I can offer you collab access to one of my dev stores to test if the the problem replicates there, but I guess you can do similar stuff yourself.
And it is probable the offender may skip dev or password-protected stores altogether.

You should have dev stores in your organization – are they affected?
Or you can’t know since Shopify’s “diagnostic” is unpredictable…

7

This email sounds more like a scare tactic from a scammer, rather than actual Shopify verbiage. Doubtful that Shopify would ever state what a specific script does (crypto), more like “we detected obfuscated JavaScript”.

That screenshot actually doesn’t say anything about code being removed. It does mention “malicious code” but that could be simply taking your word for it. But I just want to point out that they did ask what email address sent the email. That’s interesting don’t you think? Why would they ask that?

Anyway you’ve cleared everything and changed passwords and the code was “removed”.

8

If I want to check whether code was added or removed from a live Shopify theme, I usually compare it with my local version of the theme.

All the themes I work on are pushed to GitHub. This makes it very easy to track every change made to the theme and see exactly what was added, removed, or edited.

If you still have a local copy of the original theme, you can compare it with the current live theme and quickly identify the differences.

9

A few things worth checking:
Run a malware scan on all team devices that have Shopify admin access
Check your Git commit history for anything unfamiliar
Look at Settings → Users in Shopify admin for any logins from strange locations or times
Rotate all API keys and deployment credentials
For getting more from Shopify, try raising it through your Partner Dashboard directly rather than general support. It sometimes reaches a different team.
Has anyone on your team recently installed a new browser extension or worked from a new device? That is often where these things start.
Hope you get to the bottom of it soon.