Malicious Twitch Extension Leaks OAuth Tokens from 31,000 Users
A malicious browser extension marketed as a Twitch enhancement tool has been discovered exfiltrating OAuth tokens from nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, "Twitch Enhanced Viewer | JeetBot," is listed under developer HISHIMIRO/jeetbot.cc and remains available on both the Google Chrome Web Store (identifier pnhhdhhcadcjfckjhpmjneldiegbojfb) and Mozilla Firefox Add-Ons store (twitchenhancedviewer@example.com), with 30,000 and 604 installations respectively. Socket security researcher Kush Pandya revealed that current builds (v85.x) forward the token inline as an "&auth=" query parameter through a network-layer redirect to the operator's proxy for every channel the user watches—except a hardcoded allowlist of ten Russian-language streamer channels whose sessions are exempted from forwarding.
Technical analysis shows the add-on embeds code to recover the Twitch OAuth token and routes the platform's video-playlist requests to "usher.ttvnw[.]net" through operator-controlled proxy servers, appending the token as a query parameter. Because the token sits in the URL query string, it is written in cleartext into the proxy server's request logs. The leaked token can grant attackers access to a user's chat, private messages (whispers), and account settings. Earlier v4.x builds, including version 4.8 from January 2026, went even further by POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net domains. Users concerned about data exposure can run a privacy checkup to audit their current browser configuration and remove suspicious add-ons.
The operator is identified as a commercial Twitch, Kick, and VK-Live bot SaaS with broad Twitch host permissions that relays live authenticated sessions through its own infrastructure. The hardcoded allowlist of exempted channels includes prominent Russian-language streamers such as akyuliych (1.1M followers), pch3lk1n (580K followers), lagoda1337 (225K followers), forzorezor (177K followers), flamie (132K followers), and lagoda (77.3K followers)—suggesting a targeted operational relationship rather than a blanket exemption. JeetBot advertises features including ad-free viewing, region-unlocked 1080p streams, message speech synthesis, automatic translation, and viewer interaction bots, claiming a user base exceeding 2 million.
Both Chrome and Firefox listings remain live at the time of writing, and the extension's deceptive marketing makes detection difficult for average users. Security teams should treat any installed instance as compromised and immediately revoke active Twitch sessions through account settings. IT administrators can also deploy a VPN/proxy detector to identify traffic being routed through unauthorized infrastructure, while end users concerned about token theft should consider a browser fingerprint test to evaluate what their browser is leaking to visited sites. The incident underscores the persistent risks of supply-chain malware distributed through official extension stores.