Reported by 3 outlets

Timeline

1. original reporting

   Malicious Twitch Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

   cyberpress.org · 29d ago · September 14th, 2026

   A browser extension marketed as a Twitch enhancement tool has been found forwarding live OAuth session tokens belonging to more than 30,000 users to proxy infrastructure linked to a Russian-language bot service. Socket’s Threat Research Team identified the extension, named “Twitch Enhanced Viewer | JeetBot,” across both the Chrome Web Store and Firefox Add-ons repository. The Chrome version, tracked as extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb , had roughly 30,000 users, while the Firefox release had another 552 users. Malicious Twitch Extension Exposes 30,000 Users’ OAuth Tokens The extension advertises features designed to appeal to Twitch viewers, including advertisement blocking, forced 1080p streaming, regional stream unlocking, and automatic channel-point collection. However, its traffic-routing mechanism exposes a significantly more sensitive credential than is required to deliver video playback. The extension’s content script captures the Authorization header used by Twitch’s web client, along with the Twitch device ID, and passes those values to its background process. How Malicious Twitch Extension works (Source: Socket) The background logic strips the header prefix to recover the raw OAuth token, then validates it against Twitch’s token-validation service. Kush Pandya said this demonstrates that the extension processes account-scoped OAuth credentials rather than only the limited stream playback tokens normally found in Twitch video URLs. Such OAuth tokens can

2. update from thehackernews.com

   🤖 Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens of ~31,000 users to proxy servers operated by a Russian

   thehackernews.com · 29d ago · September 14th, 2026

   🤖 Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens of ~31,000 users to proxy servers operated by a Russian

   via Mastodon https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html

3. update from bleepingcomputer.com

   Twitch extension with 30K installs exposes users’ OAuth tokens

   bleepingcomputer.com · 29d ago · September 14th, 2026

   The extension has more than 30,000 installs and is advertised as a legitimate third-party tool for Twitch that can block ads, force 1080p (full HD) playback, bypass region restrictions, and enable channel-point collection. However, an analysis from application security company Socket shows that the extension captures the authorization header used by the Twitch web client, extracts the user OAuth token, and sends the credentials through proxy servers. The servers are operated by JeetBot, a commercial Russian-language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live. In current versions of the extension, the token is appended directly to redirected proxy requests as an auth= URL parameter, ending up in the proxy server’s request logs, where the software vendor can easily retrieve it. “When the extension redirects Twitch’s video playlist request (to usher.ttvnw[.]net ) through that proxy, it appends the token as an &auth= query parameter,” Socket says . “Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs.” This process occurs for every Twitch channel the user watches, except for a set of ten Russian-language channels hardcoded into the extension’s code.