A malicious browser extension targeting Twitch users has compromised OAuth tokens belonging to nearly 31,000 individuals. The extension, called Twitch Enhanced Viewer and also known as JeetBot, was identified by researcher Kush Pandya from Socket.
The Chrome version accumulated approximately 30,000 installations after its publication on June 26, 2025, while the Firefox edition reached 604 users following its release on July 7, 2025. It lured victims with promises of 1080p streaming in quality-restricted regions and an ad-free viewing experience.
In the background, the extension captured users' session tokens and forwarded them to attacker servers as query parameters during network-level redirects. This method kept the data exfiltration invisible to the extension interface. On the receiving servers, the tokens were stored in plaintext.
With these tokens, attackers could access live chat, read and send private messages, and modify account settings of affected users. At the time of the disclosure, both versions remained listed in official browser stores, leaving the campaign active.
Security experts recommend disabling the extension immediately to stop further token transmission. Because disabling alone does not revoke already stolen tokens, users must also terminate all active Twitch sessions to invalidate credentials held by the operators.
