Were you forwarded this email? Sign up here to get the next edition.

Despite all the AI investment and constant announcements from tech companies, it still amazes me how manual and slow it is to get support when their platforms fail. Today's first story shows that. I don't want AI to deliver my pizza, create a cartoon avatar or publish me in Algeria. I want it to help me keep my customers safe. Sorry, I'm a little tired and a little ranty today. I blame AI.

CHEERS, BUSHY

01

It's been a hectic, frustrating week for many ecommerce stores. Unconfirmed reports say that 400+ Shopify apps could have been impacted, including well-known apps such as Swym, Consentmo, Rebuy and Boost.

Essentially, malicious code in Shopify apps sent some shoppers from the cart to a fake checkout. It collected their payment details and then sent them back to the real one. I've seen these fake pages. They looked identical to the site checkout except for a slightly different logo and the US as the default country instead of Australia. Customers wouldn't notice. This is a good explainer. Our friend on the show, Martin Cox, has recorded a new episode on it too.

The issue is that retailers are scrambling because it's unclear which apps were hit, which customers landed on the fake page and how bad it is. Logs are really hard to get. I'm amazed Shopify hasn't issued a strong statement, since it's affecting verified Shopify apps. Shopify has put out a message to app developers but brands have spent the week playing Detective Morse for any scrap of information just before peak. Some have taken their stores down as a precaution. It's not that bad for most so don't panic-deactivate. Be aware, take the preventative steps and communicate with customers if you are unsure.

Big credit to the apps that stepped up. Swym and Rebuy released statements and were proactive in their comms. We started a thread in the ATC Community to connect those investigating.

Likely related, on 20 October Shopify pushed a change that asks customers to confirm before leaving your store. Some retailers saw Amazon links trigger the pop-up. You can now add trusted domains in Online Store > Preferences, which fixes the annoying message when customers click external links to trusted sites. It’s not great CX.

Alongside this, two critical PHP flaws were patched on 21 October (CVE-2026-109618 and CVE-2026-109619). Sites on WordPress/WooCommerce, Magento and Drupal are exposed until the host updates PHP. It's impacted the biggest sites in the world including government sites and Wikipedia.

These attacks are going to become more common. Mid-tier brands can't afford a full-time security team. I see a real market for dev agencies with ratchets of steel that want to pivot into security.

02

Meta released its Q3 results this week and Muse was the new love child. Zuckerberg said Muse now has more than 10 million users and they got there quicker than ChatGPT. But the most interesting bit... Shopping is a top use for Muse users. Over a quarter of the engaged users who shopped through it spent an average of more than $200.

Terrifyingly, Zucks also said they'll monetise sooner than their usual playbook. Put the two together: if more customers are using Muse to purchase and Meta wants to make money off it, Meta's not just coming for your ad spend. You've got a new business partner in town who wants a clip of sales.

Claude has also opened a waitlist for Duet, a personal assistant you can message by text or voice. Its launch page names Stripe, Link and Shop Pay for purchases you approve, so they're clearly focused on offloading transactions for customers too. It's US only for now. Despite every research headline you see today, customers won't be averse to agents shopping for them. Just in their current form.

03

If you heard your CRM team wail in despair this week, Salesforce will acquire Braze in a $5.66 billion cash deal. It still needs shareholder and regulatory approval.

It's a fascinating move. Braze was positioned as an alternative to Salesforce Marketing Cloud and was genuinely challenging the industry. Salesforce has a history of gobbling up companies that vaguely threaten its territory. Braze will keep its identity and sit alongside Marketing Cloud, CRM and Data 360. Australian clients include David Jones, Temple & Webster, Adairs, Total Tools, Jaycar and Sephora. These are the brands that could afford Salesforce, but whether they want Braze in Salesforce clothing is another story. Other marketing platforms will be circling.

04

Baptist World Aid has released the 11th edition of its ethical fashion report. Brands are scored out of 100 across policies and governance, tracing, supplier relationships, worker empowerment and environmental sustainability. The average was 31.5. Local brands in the top 20% included AS Colour, Kathmandu, Lorna Jane, Princess Polly, RM Williams and Nudie Jeans, all above 50. The bottom 20% included White Fox, LSKD, Ghanda and Bec & Bridge, all under 5.

Shein scored 28. That's below the average but it still doesn't pass the sniff test. Keep in mind that the brands that tended to score higher took part in the survey, while the rest were scored using only public information. Shein took part. There's plenty of debate about how the scores are calculated, but it's essentially a call for more transparency in fashion. That's never a bad thing.

05

The future of creatives and designers in an AI world was a hot topic this week. Instagram's chief, Adam Mosseri, commented on an artist's post complaining about AI slop. He said it's practically impossible to stop but they're trying to drive more reach to original creators.

At the same time, Australian tech company and friend of the show Cuttable raised a $20 million Series A led by Airtree and relaunched. It connects to your Meta, TikTok, Shopify, Klaviyo and Triple Whale data and automatically creates the ads it thinks will perform. Grab a coffee in the morning and open the platform to find a bunch of new ads ready to publish based on last night's data, your brand guidelines and your creative library. Wild.

YouTube also has a thought-provoking report showing AI and creativity don't have to be mutually exclusive. Creators are bringing the two together with alternate versions of themselves, digital costume changes, virtual runways and fandoms brought to life.

If your favourite creative is feeling a little depleted, there are awards to nominate them for. Globally, Instagram's Rings celebrate creators taking creative chances. Closer to home, the Content Summit Awards are underway and the amazing Zhoe Low is asking you to nominate the people on your team who are smashing it with content marketing. Go give them a bit of love. It's not easy out there.

As a snide aside, maybe AI could save retailers like Myer, which took its Christmas campaign in-house. What was once their flagship is now a simple tagline, "Say More", with a cast that looks like the Australian version of Succession. In a cost-of-living crisis, it doesn't look like my store.

ATC PLAYBOOK #675

Some customers wish they never had to find you.

Most ecommerce marketing is built on desire. A new season collection, an upgraded model or a creator getting overexcited. But some of the best businesses in ecom sell products that are a bit... awkward. Products tied to a diagnosis, a life stage nobody planned or something a bit taboo. The ad platforms get nervous and non-target customers get a bit weird about it. There's an art to marketing them.

Norm Douglas is CEO of Conni, which has made reusable absorbent products in North Geelong for around 25 years. His team talks about pee and poo as plainly as sizing.

Examples from this Playbook

🛏️ Norm at Conni says that most customers needed you four weeks ago. Write down the moments they start looking, then the exact words they'd type into Google or ChatGPT.

🧭 Lucy from Normal built its store around a nervous first-time buyer. Read your best seller as that buyer. Every question they'd be too embarrassed to ask should already be answered.

💬 Alice at Ovira advises saying the words first and saying them normally. Put your reviews and site search terms next to your product copy. If they don't match, change yours.

🚩 Chloe at NALA gets censored all the time, so every ad is approved before it goes into the account. Expect rejections and build in time to appeal.