Twitch extension with 30K installs exposes users’ OAuth tokens
Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.
Socket analysis shows the "Twitch Enhanced Viewer | JeetBot" browser extension, with over 30,000 installs on the official Chrome and Firefox stores, captures the Twitch web client's authorization header and extracts the user's OAuth token. The token is appended as an auth= URL parameter to video playlist requests routed through JeetBot proxy servers, landing in cleartext request logs retrievable by the Russian-language bot service vendor; ten hardcoded Russian-language channels are exempted. Earlier versions used more explicit token exfiltration, and the extension remained live in both stores at publication. Socket recommends removing the extension, disconnecting all Twitch sessions, and re-authenticating.
- 30,000+ installs across official Chrome Web Store and Firefox Add-ons
- Extension extracts Twitch OAuth tokens from web client authorization headers
- Tokens appended as auth= URL params, written in cleartext to proxy server logs
- Ten hardcoded Russian-language Twitch channels exempted from token capture
- Users should remove extension, revoke sessions, and re-authenticate
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ttvnw.net | tension redirects Twitch’s video playlist request (to usher.ttvnw[.]net ) through that proxy, it appends the token as an &auth= q |
From the original article
2 min read at bleepingcomputer.com
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.