Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users

A browser extension promoted as a Twitch viewing helper has been found sending live account tokens through servers controlled by its operator.

The add-on, called “Twitch Enhanced Viewer | JeetBot,” was available to Chrome and Firefox users and advertised conveniences such as ad blocking, higher-quality playback, region-unlocked streams, and automatic channel-point collection.

The risk sits behind those seemingly useful features. To alter video delivery, the extension reroutes Twitch playlist requests through third-party proxies.

During that process, it captures the logged-in user’s OAuth session token and exposes it to those proxy systems, turning an entertainment add-on into a potential account-takeover channel.

Analysts at Socket.dev identified the cross-store extension and found that its current releases transmitted the credential for nearly every channel a victim watched.

The Chrome listing showed roughly 30,000 users, while the Firefox listing recorded 552, putting the exposure at about 31,000 installations across the two browsers.

Socket.dev said in a report shared with Cyber Security News (CSN) that the extension sent a live Twitch OAuth token to infrastructure linked to a Russian commercial bot service.

The findings add to a growing pattern in which trusted-looking add-ons abuse permissions, as seen in malicious Firefox add-ons stealing OAuth.

Malicious Twitch Extension Exposes OAuth Tokens

The extension did not need to trick users into entering a password on a fake page. Its page script read the Authorization header used by Twitch’s own web client, passed that data to a background worker, and recovered the raw OAuth token.

This account-level credential is more sensitive than the separate token needed to fetch a video stream. When a viewer opened a channel, the add-on redirected the playlist request to an operator-controlled proxy and added the account token as an auth parameter in the address.

That design means the token could be written in clear text to proxy request logs. Firefox and Chrome used different browser mechanisms, but produced the same outcome.

The current v85.x releases excluded only ten hardcoded Russian-language streamer channels from token forwarding. Every other viewed channel could trigger it.

Earlier v4.x releases were more direct, posting captured tokens to a dedicated set-token endpoint and using backup collection locations if necessary.

A stolen OAuth token acts as a bearer credential, meaning somebody who has it may use the account without knowing the password or passing a second-factor check.

The report says the token can enable chat and whisper activity, account-setting access, and channel-point spending. Similar abuse of active sessions has featured in Chrome extension code injection attacks.

Account recovery and enterprise response

The extension’s store disclosures reportedly said user data would not be collected or processed, yet the observed forwarding contradicted those claims.

Its broad access to Twitch services and a third-party proxy destination created the exposure. This is why users should treat extensions that handle traffic from a logged-in website as capable of reaching valuable session credentials.

Anyone who installed Twitch Enhanced Viewer | JeetBot should remove it from Chrome or Firefox, then use Twitch account settings to disconnect all sessions and sign in again.

That action invalidates tokens sent while the extension was active. Users should also review recent chat, whispers, settings, and point activity for changes they did not make before using the account again.

Security teams should search managed browser inventories for the two extension identifiers and block the listed infrastructure at the network layer.

They should pay close attention to add-ons with host permissions for authenticated services and external proxy destinations. Recent cases involving compromised browser extensions stealing credentials show why permission and publisher changes merit prompt review.

For developers, the central lesson is simple: never send authentication headers or tokens through a third-party server merely to provide a convenience feature.

If proxying is unavoidable, credentials should be removed before traffic leaves the browser, and the behavior should be clearly disclosed. Users can reduce their exposure by keeping only necessary extensions and checking new permissions before accepting updates.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users appeared first on Cyber Security News.