Fraudulent Shopify stores running ‘Outsider’-linked phishing kits

**Executive Summary:** Research from September 2026 documents an active, industrialized phishing campaign that registers malicious Shopify storefronts and injects a custom theme asset (custom-checkout-redirect.js) to redirect checkout to attacker-controlled payment pages; two phishing kits (Outsider/JWR and Playswing) are used to harvest cards, payment credentials, and identity data at scale, with exposed admin infrastructure, role-based operator tooling, Google Ads integration, and a list of IOCs for detection and takedown.