Vulnerabilities · 45 days ago
Socket said the Twitch Enhanced Viewer | JeetBot browser extension forwarded account-scoped Twitch OAuth tokens from nearly 31,000 users to proxy servers run by a Russian commercial bot service. The add-on was live on the Chrome Web Store and Firefox Add-ons, and the token ride-along was confirmed in current v85.x builds.
The extension sends Twitch video requests through operator-controlled infrastructure and appends the user's OAuth token as a URL parameter. That puts the bearer token in proxy logs in clear text, and anyone who gets it can act as that Twitch user for chat, whispers, and account settings without needing the password or 2FA.
The durable exposure is in the tokens and sessions already copied, not just in the extension package. If an account used JeetBot, removing the add-on does not undo a stolen bearer token until Twitch revokes the live sessions that token can still open.
4 sources covering this story
Twitch extension with 30K installs exposes users’ OAuth tokens
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service.
Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens
Socket has discovered a Twitch browser extension forwarding users' OAuth tokens to a Russian bot service
Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
JeetBot's Twitch extension sent OAuth tokens from nearly 31,000 users to operator-controlled proxies; Firefox 85.8.7 stops the behavior.
Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.
Part of the PlainSec briefing for 2026-09-15