Twitch Extension Bug Exposed 30,000 User OAuth Tokens

Key Takeaways

• A malicious browser extension, “Twitch Enhanced Viewer | JeetBot,” exposed OAuth tokens of approximately 30,000 Chrome and 552 Firefox users.
• The extension, masquerading as a Twitch viewing helper, secretly redirected users’ video requests through operator-controlled proxies, capturing and transmitting sensitive OAuth session tokens.
• These exposed tokens could enable full account takeover, allowing attackers to access chats, whispers, account settings, and spend channel points without needing a password or multi-factor authentication.
• The incident highlights a growing trend of seemingly innocuous browser extensions abusing permissions to steal credentials.

Malicious Twitch Extension JeetBot Exposed 30,000 User OAuth Tokens

A widely used browser extension, deceptively advertised as a tool to enhance the Twitch viewing experience, has been found to be actively transmitting users’ live account tokens to external servers managed by its operator. This discovery has put approximately 30,000 Chrome users and 552 Firefox users at risk of account compromise.

The Deceptive Nature of “Twitch Enhanced Viewer | JeetBot”

The extension, named “Twitch Enhanced Viewer | JeetBot,” was available on both Chrome and Firefox marketplaces. It promised a range of appealing features, including ad blocking, improved video quality, access to geo-restricted streams, and automatic collection of channel points. However, these seemingly beneficial functionalities concealed a critical security flaw.

The core mechanism behind these features involved rerouting Twitch playlist requests through third-party proxy servers. During this redirection, the extension secretly intercepted and exposed the logged-in user’s OAuth session token to these proxy systems. This transformed a utility add-on into a conduit for potential account takeovers.

Discovery and Scope of the Breach

Security analysts at Socket.dev said in a report that they identified this cross-browser extension and confirmed that its current versions were systematically transmitting user credentials for nearly every channel a victim viewed. The Chrome Web Store listing indicated roughly 30,000 active users, while the Firefox Add-ons store showed 552 users, bringing the total number of affected installations to approximately 31,000 across both platforms. The report further revealed that the extension was sending live Twitch OAuth tokens to infrastructure linked to a Russian commercial bot service. This incident underscores a concerning pattern where seemingly trustworthy add-ons exploit their permissions, mirroring other recent cases of malicious Firefox add-ons stealing OAuth tokens.

How the Tokens Were Compromised

The “Twitch Enhanced Viewer | JeetBot” extension did not rely on phishing tactics to trick users into divulging their passwords. Instead, its page script directly read the Authorization header utilized by Twitch’s own web client. This data was then passed to a background worker, which extracted the raw OAuth token. This account-level credential is significantly more sensitive than the separate token required merely to fetch a video stream.

When a user accessed a Twitch channel, the extension would redirect the playlist request to an operator-controlled proxy. Crucially, it appended the sensitive account token as an auth parameter within the URL. This design flaw meant that the token could be logged in clear text by the proxy servers, making it easily accessible to the extension’s operators. While Chrome and Firefox employ distinct browser mechanisms, both ultimately led to the same critical exposure.

The current v85.x releases of the extension were configured to forward tokens for almost all viewed channels, with the exception of ten specific Russian-language streamer channels that were hardcoded to be excluded. Earlier v4.x releases exhibited an even more direct approach, actively posting captured tokens to a dedicated set-token endpoint and utilizing backup collection locations when necessary.

A stolen OAuth token functions as a bearer credential. This means that anyone possessing it can gain unauthorized access to the associated Twitch account without needing the user’s password or bypassing multi-factor authentication. According to the report, such a token could enable malicious actors to engage in chat and whisper activity, access and modify account settings, and even spend channel points. This type of active session abuse has been observed in other Chrome extension code injection attacks.

What You Should Do

If you have installed “Twitch Enhanced Viewer | JeetBot,” immediate action is required to secure your account.

• Remove the Extension: Uninstall “Twitch Enhanced Viewer | JeetBot” from both Chrome and Firefox immediately.
• Invalidate Sessions: Navigate to your Twitch account settings. Disconnect all active sessions and then sign back into your account. This action will invalidate any tokens compromised while the extension was active.
• Review Account Activity: Before resuming normal use of your Twitch account, meticulously review your recent chat logs, whispers, account settings, and channel point activity for any unauthorized changes or actions.
• For Enterprise Users: Security teams should identify the extension’s identifiers (pnhhdhhcadcjfckjhpmjneldiegbojfb for Chrome and [email protected] for Firefox) within managed browser inventories and remove them. Additionally, block the associated infrastructure at the network layer using the provided Indicators of Compromise (IoCs). Pay close attention to add-ons requesting broad host permissions for authenticated services and those with external proxy destinations.
• Developer Best Practices: Developers must never transmit authentication headers or tokens through third-party servers for convenience features. If proxying is essential, credentials must be stripped before traffic leaves the browser, and such behavior must be explicitly disclosed to users.
• General User Advice: Minimize your browser extension footprint to only those that are absolutely necessary. Always review new permissions requested by extensions, especially before accepting updates.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.