Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' available on Chrome and Firefox has been exfiltrating users' live Twitch OAuth session tokens to proxy servers controlled by a Russian commercial bot service. The extension, marketed as a quality-of-life tool for Twitch users, forwards the tokens via URL query parameters during video playlist proxying, exposing approximately 30,000 Chrome and 552 Firefox users to potential account compromise. Earlier versions actively collected and POSTed tokens to dedicated endpoints, while current versions silently leak tokens through inline forwarding, except for a hardcoded allowlist of ten Russian streamer channels.

AI-extracted · verify before operational use