A browser extension promoted as a Twitch viewing helper has been found sending live account tokens through servers controlled by its operator.

The add-on, called “Twitch Enhanced Viewer | JeetBot,” was available to Chrome and Firefox users and advertised conveniences such as ad blocking, higher-quality playback, region-unlocked streams, and automatic channel-point collection.

The risk sits behind those seemingly useful features. To alter video delivery, the extension reroutes Twitch playlist requests through third-party proxies.

During that process, it captures the logged-in user’s OAuth session token and exposes it to those proxy systems, turning an entertainment add-on into a potential account-takeover channel.

Analysts at Socket.dev identified the cross-store extension and found that its current releases transmitted the credential for nearly every channel a victim watched.

The Chrome listing showed roughly 30,000 users, while the Firefox listing recorded 552, putting the exposure at about 31,000 installations across the two browsers.

The JeetBot extension's attack lifecycle (Source - Socket.dev) — The JeetBot extension’s attack lifecycle (Source – Socket.dev)

Socket.dev said in a report shared with Cyber Security News (CSN) that the extension sent a live Twitch OAuth token to infrastructure linked to a Russian commercial bot service.

The findings add to a growing pattern in which trusted-looking add-ons abuse permissions, as seen in malicious Firefox add-ons stealing OAuth.

Malicious Twitch Extension Exposes OAuth Tokens

The extension did not need to trick users into entering a password on a fake page. Its page script read the Authorization header used by Twitch’s own web client, passed that data to a background worker, and recovered the raw OAuth token.

This account-level credential is more sensitive than the separate token needed to fetch a video stream. When a viewer opened a channel, the add-on redirected the playlist request to an operator-controlled proxy and added the account token as an auth parameter in the address.

That design means the token could be written in clear text to proxy request logs. Firefox and Chrome used different browser mechanisms, but produced the same outcome.

The current v85.x releases excluded only ten hardcoded Russian-language streamer channels from token forwarding. Every other viewed channel could trigger it.

Earlier v4.x releases were more direct, posting captured tokens to a dedicated set-token endpoint and using backup collection locations if necessary.

A stolen OAuth token acts as a bearer credential, meaning somebody who has it may use the account without knowing the password or passing a second-factor check.

The Firefox Add-ons listing for the same extension (Source - Socket.dev) — The Firefox Add-ons listing for the same extension (Source – Socket.dev)

The report says the token can enable chat and whisper activity, account-setting access, and channel-point spending. Similar abuse of active sessions has featured in Chrome extension code injection attacks.

Account recovery and enterprise response

The extension’s store disclosures reportedly said user data would not be collected or processed, yet the observed forwarding contradicted those claims.

Its broad access to Twitch services and a third-party proxy destination created the exposure. This is why users should treat extensions that handle traffic from a logged-in website as capable of reaching valuable session credentials.

Anyone who installed Twitch Enhanced Viewer | JeetBot should remove it from Chrome or Firefox, then use Twitch account settings to disconnect all sessions and sign in again.

That action invalidates tokens sent while the extension was active. Users should also review recent chat, whispers, settings, and point activity for changes they did not make before using the account again.

Security teams should search managed browser inventories for the two extension identifiers and block the listed infrastructure at the network layer.

They should pay close attention to add-ons with host permissions for authenticated services and external proxy destinations. Recent cases involving compromised browser extensions stealing credentials show why permission and publisher changes merit prompt review.

For developers, the central lesson is simple: never send authentication headers or tokens through a third-party server merely to provide a convenience feature.

If proxying is unavoidable, credentials should be removed before traffic leaves the browser, and the behavior should be clearly disclosed. Users can reduce their exposure by keeping only necessary extensions and checking new permissions before accepting updates.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Operator identifier	Popov Aleksandr Alekseevich	Self-identified in the JeetBot website footer
Store developer handle	HISHIMIRO	Developer name associated with the extension listings
Email address	support@jeetbot[.]cc	Operator contact address
Email address	cybergnyda@gmail[.]com	Developer email listed by chrome-stats
Website identifier	alexue4[.]dev	Copyright identifier linked to the operator
IP address	152[.]53[.]177[.]186	netcup GmbH, Germany, AS197540; hosts jeetbot[.]cc, api[.]jeetbot[.]cc, enhanced[.]jeetbot[.]cc, and enhanced-1[.]jeetbot[.]cc
IP address	132[.]243[.]113[.]25	CLODO Cloud, AS216154; hosts ext-styles[.]jeetbot[.]cc, morphilina[.]me, and drisnya[.]online
IP address	80[.]74[.]26[.]162	CLODO Cloud, AS216154; hosts ext-03[.]jeetbot[.]cc
Domain	jeetbot[.]cc	Operator-controlled domain
Domain	api[.]jeetbot[.]cc	Operator API host
C2 and proxy endpoint	enhanced[.]jeetbot[.]cc	Default proxy that received forwarded tokens
C2 and proxy endpoint	enhanced-1[.]jeetbot[.]cc	Alternate operator proxy
C2 and proxy endpoint	ext-03[.]jeetbot[.]cc	Alternate operator proxy
C2 and proxy endpoint	proxy[.]morphilina[.]me	Token-strip proxy endpoint
Configuration endpoint	ext-styles[.]jeetbot[.]cc/api/v1/proxies	Proxy catalog endpoint
Configuration endpoint	ext-styles[.]jeetbot[.]cc/api/v1/forced-proxy	Forced-proxy configuration endpoint
API endpoint	api[.]jeetbot[.]cc/api/v2/public/extension_helper/	Public extension-helper API endpoint
Screenshot host	img[.]drisnya[.]online	Image hosting endpoint associated with the operation
Historical collection endpoint	enhanced[.]jeetbot[.]cc/set-token	Decommissioned token-collection endpoint
Historical collection endpoint	thebeholder-proxy[.]deno[.]dev/set-token	Decommissioned backup token-collection endpoint
Historical collection endpoint	proxy[.]thebeholder[.]deno[.]net/set-token	Decommissioned backup token-collection endpoint
Privacy-policy URL	thebeholderbotapi[.]vercel[.]app/twitch-conf	Privacy-policy host cited in the investigation
Chrome extension	pnhhdhhcadcjfckjhpmjneldiegbojfb	Twitch Enhanced Viewer \| JeetBot Chrome Web Store extension ID; SHA-256: `e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8`
Firefox extension	twitchenhancedviewer@example.com	Twitch Enhanced Viewer Firefox Add-ons ID; SHA-256: `141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users appeared first on Cyber Security News.