Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens
Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' forwarded live OAuth session tokens of roughly 31,000 users to Russian JeetBot proxy servers.
Socket research found the cross-store extension Twitch Enhanced Viewer | JeetBot (about 30,000 Chrome users and 552 Firefox users) routing Twitch video requests through JeetBot proxy servers with the account-scoped OAuth bearer token appended in cleartext as a URL query parameter. Version 4.x builds, including 4.8 from January 2026, posted captured tokens to dedicated set-token endpoints on JeetBot infrastructure with backups on two Deno services. Token holders can read and send whispers, post in chat, and spend channel points without a password or 2FA; listings were still live at publication and users are advised to remove the extension and re-authenticate.
- Roughly 31,000 users' account-scoped OAuth bearer tokens forwarded to JeetBot proxies.
- Tokens exposed in cleartext proxy logs as URL query parameters.
- Version 4.8 posted tokens to set-token endpoints with Deno backups.
- Extension remained live on Chrome Web Store and Firefox Add-ons.
- Affected users should remove the extension and re-authenticate all sessions.
From the original article
2 min read at infosecurity-magazine.com
Socket has discovered a Twitch browser extension forwarding users' OAuth tokens to a Russian bot service
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.