JeetBot

Malicious Twitch Extension Steals OAuth Tokens from Nearly 31,000 Users

A browser extension posing as an enhancement for Twitch has been stealing OAuth authentication tokens from approximately 31,000 users across Chrome and Firefox. The extension, known as Twitch Enhanced Viewer or JeetBot, was discovered by researcher Kush Pandya of Socket. It promised 1080p streaming in restricted regions and an ad-free experience while covertly exfiltrating session tokens to attacker-controlled servers. The tokens were transmitted in plaintext via network-layer redirects, allowing full access to chat functions, private messages, and account settings. Both the Chrome version with around 30,000 installations since June 26, 2025, and the Firefox version with 604 users since July 7, 2025, remained available in official stores at the time of reporting. Users are advised to immediately disable the extension and revoke active Twitch sessions to invalidate stolen tokens.

Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users

The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue surfaced prominently in the v85.x branch where tokens were appended as the &auth= query parameter during network redirects to operator-controlled proxy servers, exposing them in clear text within proxy logs. Earlier v4.x versions had already transmitted tokens via POST requests to a set-token endpoint and backup servers on deno.dev and deno.net. A fix appeared in Firefox version 85.8.7 that stops token exfiltration by altering playlist retrieval, while a Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.

Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users

The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operator’s proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.