Socket said the Twitch Enhanced Viewer | JeetBot browser extension forwarded account-scoped Twitch OAuth tokens from nearly 31,000 users to proxy servers run by a Russian commercial bot service. The add-on was live on the Chrome Web Store and Firefox Add-ons, and the token ride-along was confirmed in current v85.x builds.
The extension sends Twitch video requests through operator-controlled infrastructure and appends the user's OAuth token as a URL parameter. That puts the bearer token in proxy logs in clear text, and anyone who gets it can act as that Twitch user for chat, whispers, and account settings without needing the password or 2FA.
The durable exposure is in the tokens and sessions already copied, not just in the extension package. If an account used JeetBot, removing the add-on does not undo a stolen bearer token until Twitch revokes the live sessions that token can still open.
Twitch extension with 30K installs exposes users’ OAuth tokens
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service.