Malicious Twitch Extension Exposes OAuth Tokens of More Than 30,000 Users

The extension, “Twitch Enhanced Viewer | JeetBot,” was available through both the Google Chrome Web Store and Mozilla Firefox Add-ons. Security researchers at Socket found approximately 30,000 Chrome installations and 552 Firefox installations.

The extension promoted features including ad blocking, higher-quality streaming, region unlocking and automatic channel-point collection. However, its network-handling mechanism exposed a much more sensitive credential than was necessary for video playback.

How the OAuth Token Exposure Worked

The extension intercepted Twitch's authenticated web traffic and obtained the Authorization header containing the user's OAuth session token.

Instead of keeping that credential inside the browser, the extension passed it to its background component and subsequently included the token as an auth parameter when redirecting Twitch video requests through operator-controlled proxy servers.

Because the credential was placed directly into a URL, it could also be recorded in proxy access logs in clear text.

Researchers noted that the token was an account-level Twitch OAuth credential, rather than the separate token used specifically for video playback. As a result, possession of the token could potentially provide access to functions such as Twitch chat, private messages and account settings.

Why the Attack Is Significant

The extension did not require victims to enter their passwords into a phishing page.

Instead, the credential was collected silently while users watched Twitch streams through the extension.

The basic attack flow was:

Twitch login → Extension captures OAuth token → Token passed to extension background process → Video request redirected through third-party proxy → OAuth token included in request → Token potentially stored in proxy logs → Account takeover risk

This makes the incident particularly significant because users may have considered the extension trustworthy simply because it was distributed through official browser extension stores.

Russian-Linked Proxy Infrastructure

Socket identified proxy infrastructure associated with a Russian commercial bot service.

The extension's infrastructure included domains associated with the JeetBot service, which provides automation capabilities for platforms including Twitch, Kick and VK-Live.

Researchers also discovered a hardcoded list of approximately 10 Russian-language Twitch channels whose traffic was excluded from the token-forwarding behavior.

The presence of those exceptions does not by itself establish the operator's motive, but it was one of the findings highlighted in the investigation.

Older Versions Used a Different Exfiltration Method

The exposure was not limited to the latest implementation.

Socket found that earlier 4.x versions of the extension used a different mechanism, sending captured tokens through a dedicated endpoint using HTTP POST requests.

More recent versions instead placed the OAuth credential directly into the proxy URL.

This is important for defenders because simply searching for one specific exfiltration pattern may not identify historical versions of the extension.

Potential Impact

A stolen Twitch OAuth token can represent a significant account security risk because it may allow an attacker to act as the authenticated user without obtaining the account password.

Potential consequences include:

There is currently no evidence in the available reporting that all exposed tokens were actually abused. The confirmed issue is that the extension transmitted account-level OAuth credentials to third-party infrastructure.

What Users Should Do

Anyone who has installed Twitch Enhanced Viewer | JeetBot should treat the extension as potentially compromised.

Recommended actions include:

• Disable or remove the extension immediately.
• Revoke active Twitch sessions or connected applications associated with the account.
• Change the Twitch account password as an additional precaution.
• Enable or verify multi-factor authentication.
• Review account settings for unauthorized changes.
• Check recent activity for unexpected messages or account actions.
• Avoid reinstalling older versions of the extension.

The extension's developer reportedly changed the token-handling mechanism in a later version, but users with older installations should not assume their previously exposed tokens are automatically safe.

Broader Security Lesson

This incident highlights a major weakness in the browser-extension ecosystem: an extension does not need to look malicious to become a credential-exfiltration mechanism.

Browser extensions can operate with significant access to web traffic and browser data. A legitimate-looking feature such as ad blocking or video optimization can therefore provide a convincing reason for users to install software capable of accessing sensitive authentication information.

Organizations should consider browser extensions part of their software supply-chain and identity-security risk. Enterprise environments can reduce exposure by maintaining extension allowlists, monitoring newly installed extensions and restricting extensions with unnecessary access to authenticated web applications.

For individual users, the safest approach is to install only extensions from trusted developers, minimize permissions and periodically review installed browser extensions.