Malicious Twitch Extension Siphoned ~31,000 OAuth Tokens to a Russian Bot Proxy

Researchers at Socket identified a cross-store browser extension, "Twitch Enhanced Viewer | JeetBot" (listed under developer HISHIMIRO / jeetbot.cc), that forwarded users' live Twitch OAuth session tokens to proxy servers operated by a commercial Russian-language bot service. The Chrome Web Store listing (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb) had around 30,000 users; the Firefox Add-ons listing had roughly 552. Combined, The Hacker News puts the exposure at nearly 31,000 users.

How the token theft worked

The extension's content script reads the Authorization header Twitch's own web client attaches to its requests and passes the captured OAuth token to the extension's background service worker. According to Socket researcher Kush Pandya, current builds (v85.x) then append that token inline as an &auth= query parameter when redirecting the user's video-playlist requests through the operator's proxy servers — a mechanism that blends the exfiltration into what looks like ordinary video-CDN traffic. Earlier v4.x builds were cruder, POSTing tokens directly to a dedicated endpoint.

Putting a session token in a URL query string has a second-order consequence beyond deliberate collection: it also lands in the operator's own routine proxy access logs, widening who could plausibly obtain a live, working token beyond the original operator.

A deliberate carve-out — and a named operator

Socket found that ten hardcoded Twitch channels, all belonging to Russian streamers, were explicitly excluded from token forwarding. The proxy infrastructure belongs to JeetBot, a commercial bot service offering view/chat automation across Twitch, Kick and VK Live, which claims over 26,000 active streamers and more than a billion processed chat messages. Researchers noted the operator identified himself in the JeetBot site's own footer as "Popov Aleksandr Alekseevich." At the time Socket published its findings, both storefront listings remained live, with no confirmed patched release for either browser.

Why it matters beyond Twitch

A live OAuth session token lets whoever holds it act as the user — post chat messages, manage stream settings, or interact with connected services — without needing the account password or a second factor. For anyone running a Twitch channel as part of a brand or business presence, an extension installed on a streaming machine is functionally a third-party dependency with broad account access, no different in risk category from an unvetted npm or PyPI package: official store review at install time says nothing about what a later version update will do.

• Extensions are supply chain, not just software. Official Chrome Web Store / Firefox Add-ons listing and review does not guarantee a later auto-updated version stays benign.
• Uninstalling isn't remediation. A token already sent to the operator's proxy stays valid until it is explicitly revoked; removing the extension only stops future leaks.
• Broad permission grants deserve scrutiny. A "viewer enhancement" extension that requests the ability to read and modify data on the target site is requesting session-level trust, not cosmetic access.

What to do if you or your team run this extension

1. 1Remove the extension from any browser profile it was installed on.
2. 2In Twitch account settings, review Connections and revoke any unrecognized authorized applications, then re-authenticate.
3. 3For organizations that manage branded streaming accounts, treat this as a reminder to inventory which browser extensions are permitted on machines with access to business social/streaming accounts.