[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvEZ-YAaZpRGVF8BuwXjnzIs5bdCXKwOAEGQcP9q75-w":3},{"article":4,"iocs":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"a5768edc-d943-4225-af07-3a557f88e3c7","Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users","malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31-000-users-69430c","A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named \"Twitch Enhanced Viewer | JeetBot,\" lists HISHIMIRO\u002Fjeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome -","A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has been found to leak OAuth tokens for almost 31,000 users. These tokens are sent to proxy servers operated by a Russian commercial bot service, potentially allowing access to user chats, private messages, and account settings. The extension, available on both Chrome and Firefox stores, claims to offer enhanced Twitch features but redirects requests through malicious infrastructure.","Malicious Twitch browser extension leaks OAuth tokens of nearly 31,000 users.","Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users Ravie LakshmananSep 14, 2026Malware \u002F Browser Security A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named \"Twitch Enhanced Viewer | JeetBot,\" lists HISHIMIRO\u002Fjeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome - pnhhdhhcadcjfckjhpmjneldiegbojfb - 30,000 users (Published on June 26, 2025) Firefox - twitchenhancedviewer@example.com - 604 users (Published on July 7, 2025) Both extensions are still available for download as of writing. The extension listing description states: \"JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control,\" adding it \"expands Twitch capabilities: 1080p stream for regions with constraints.\" \"Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy,\" Socket security researcher Kush Pandya said. \"The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding.\" \"The operator is a commercial Twitch, Kick, and VK-Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure.\" While the extension claims to offer an ad-free experience and serve region-unlocked content, it does so by routing Twitch's video-playlist requests to \"usher.ttvnw[.]net\" through operator-controlled proxy servers along with the user's OAuth token as an \"&auth=\" query parameter. Specifically, the add-on embeds code to recover the Twitch OAuth token and send it to the proxy. The token can enable access to a user's chat, whispers (i.e., private messages), and account settings. Given that the token is placed in the URL query string, it gets written in cleartext into the proxy server's request logs. The token redirection mechanism, however, is excluded for a hard-coded list of 10 Twitch channels, most of them being Russian-language streamers with thousands of followers - pch3lk1n (580K followers) fasoollka (361K followers) flamie (132K followers) dosia (29 followers) fander (2 followers) almazer (4 followers) forzorezor (177K followers) akyuliych (1.1M followers) lagoda1337 (225K followers) lagoda (77.3K followers) \"For every channel outside this list, the user’s live token is forwarded to the proxy,\" Pandya explained. \"Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net.\" JeetBot advertises itself as a \"powerful bot for Twitch, Kick and VK Live with message speech synthesis, automatic translation, and many other features to enhance interaction with viewers.\" It claims to have over 26,000 active streamers and 1 billion processed messages. The site's footer identifies the operator to a Cyprus-based developer named Aleksandr Popov. On their LinkedIn profile, the developer claims JeetBot to be their pet project. However, it appears that the developer has already taken steps to address the problem. An alert issued on the JeetBot documentation page now states that version 85.8.7 of the Firefox add-on addresses the problem and that an equivalent Chrome version is currently under review - In the previous implementation, the extension sent the user's Twitch OAuth token to our proxy servers to retrieve stream playlists. An OAuth token is a credential and must be protected. Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies. Check your installed extension version and update to 85.8.7 or later. Older installations using the previous mechanism continue to send the token until updated. The documentation also urges users to temporarily disable the extension to halt further transmission of the token if the extension is not available. However, the developer warned that disabling or updating the extension does not revoke previously transmitted tokens. The Hacker News has contacted both Socket and the developer for further comment and we will update the story if we hear back. \"Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure,\" Socket said. \"A Twitch OAuth session token is a bearer credential: whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points. The exposure is undisclosed in both store listings.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, Chrome, data breach, Firefox, Identity Security, Malware, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmalicious-twitch-browser-extension.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEguNgykDjufnR6xGrMUSq67eZ5sCFxbYjf8J6pEXekhUnt-zCt2xaJ4jzj6I0wPMYjps9z2ufKJ-JSJ8ZqhGe4BcbtNWfRETdaB6QgIRVLw0CtnsM5q2qCpyI3kL7oBXmNixcTTcumZJHFgCKaoLY8kRIBDbPHslMmmzzb25TlESGooJuaxtXEL5qrUzkop\u002Fs1600\u002Ftwitch.jpg","2026-09-14T07:24:39+00:00","2026-09-14T10:00:12.032096+00:00",8,[18,21,24,27,29],{"name":19,"type":20},"Twitch Enhanced Viewer | JeetBot","product",{"name":22,"type":23},"Twitch","vendor",{"name":25,"type":26},"OAuth","technology",{"name":28,"type":20},"Google Chrome Web Store",{"name":30,"type":20},"Mozilla Firefox Add-Ons store","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"domain","jeetbot.cc","Developer domain associated with the malicious extension.",{"type":35,"value":55,"context":56},"JeetBot","Name of the malicious Twitch browser extension."]