Over the past year, we have investigated several Shopify and ecommerce websites that were experiencing intermittent, non-user-initiated redirects to external or affiliate-style domains.
In every case, store owners were told some version of:
-
“We can’t reproduce it.”
-
“It must be a browser extension.”
-
“It’s probably DNS or hosting.”
-
“We uninstalled all apps and it’s still happening.”
In reality, these redirects were not random at all.
They were caused by a specific class of frontend redirect malware that is deliberately engineered to evade detection.
Why These Redirects Appear “Random”
In all of the cases we’ve investigated, the malware followed the same general pattern:
-
A redirect payload is stored in the frontend code in an obfuscated form (most commonly base64-encoded).
-
The payload is gated behind simple logic, such as:
-
user-agent checks
-
visit counters (e.g. every 3rd or 4th visit)
-
delayed triggers (scroll, idle time, or timeouts)
-
-
The redirect logic is hidden inside otherwise legitimate theme or loader scripts, so it blends into normal site behavior.
This design makes the redirect:
-
appear intermittent
-
difficult to reproduce
-
invisible during casual testing
-
invisible on desktop in some cases
-
resistant to basic malware scans
From a defender’s point of view, it looks like “Shopify being weird.”
From an attacker’s point of view, it’s working exactly as intended.
Why Uninstalling Apps Often Doesn’t Fix It
One of the most common mistakes store owners make is assuming the redirect must be coming from a Shopify app or plugin.
In multiple cases we’ve worked, the original malicious script was:
-
injected into a theme asset
-
injected into a shared frontend loader
-
or left behind after an app was uninstalled
Once that happens, removing the original app does nothing.
The malware continues to run because it now lives inside the storefront’s own JavaScript.
Why Google Ads Gets Disapproved
Google Ads and other ad platforms actively test destination behavior.
When their crawler or a real ad user hits one of these redirect branches, the site appears to be redirecting traffic to a third-party domain without user interaction.
From Google’s perspective, that looks like:
-
cloaking
-
affiliate abuse
-
or malicious behavior
So even if only 1 out of 4 or 1 out of 10 users is affected, your Ads account can still be flagged or suspended.
Why These Infections Are Hard to Find
Most developers and IT providers look for:
-
obvious
<script src="evil.com">tags -
meta refresh redirects
-
hardcoded
window.location = "http://..." -
suspicious Shopify apps
This malware avoids all of those patterns.
Instead, it typically uses:
-
obfuscated strings (e.g. base64)
-
dynamic script injection
-
delayed execution
-
conditional logic (user-agent, counters, timing)
Unless you trace the actual execution path and correlate it with network initiators, the redirect source remains invisible.
The One Thing That Actually Works: Deterministic Analysis
The only reliable way to resolve this class of issue is to:
-
Enumerate all frontend execution contexts (theme assets, embeds, pixels, loaders).
-
Identify obfuscation and gating primitives (base64, UA checks, counters).
-
Trace execution until the redirect branch fires.
-
Prove the exact file, function, and condition that triggers navigation.
-
Remove or neutralize that execution path safely.
This is not trial-and-error debugging.
It is deterministic root-cause analysis.
A Critical Scope Boundary (And Why It Matters)
In some cases, the malicious logic is isolated and can be safely removed.
In others, it is woven into legitimate frontend logic such as routing, attribution, or mobile UX code.
In those cases, bluntly deleting code can break real storefront functionality.
When that happens, the correct solution is:
-
identify and prove the malicious branch
-
annotate the code for a developer
-
neutralize the redirect capability
-
and implement guardrails (e.g. CSP) to prevent recurrence
This keeps security work separate from theme refactoring.
Final Thoughts
If your Shopify or ecommerce site is experiencing:
-
intermittent redirects
-
mobile-only redirects
-
Ads disapprovals for “destination behavior”
-
redirects that nobody can reproduce reliably
there is a high probability you are dealing with a deliberately gated frontend malware payload.
These issues are not random.
They are engineered.
And they are solvable — once the correct execution path is identified.
LTH Cybersecurity provides redirect malware root-cause analysis for Shopify and web-based ecommerce stores.
If you are experiencing intermittent or unexplained redirects, contact us for a deterministic investigation.