Malicious Twitch Extension Exposed OAuth Tokens From Nearly 31,000 Users

Chrome and Firefox listings distributed the extension

A browser extension promising an enhanced Twitch viewing experience transmitted users’ OAuth session tokens to proxy infrastructure associated with JeetBot, a commercial bot service operating across Twitch, Kick, and VK Live.

The extension, named “Twitch Enhanced Viewer | JeetBot,” was distributed through both the Google Chrome Web Store and Mozilla Firefox Add-ons. It identifies HISHIMIRO/jeetbot.cc as its developer.

The Chrome edition uses the identifier pnhhdhhcadcjfckjhpmjneldiegbojfb. Published on June 26, 2025, it had approximately 30,000 users. The Firefox package, identified as [email protected], was published on July 7, 2025, and had 604 users.

Together, the listings exposed nearly 31,000 people. Both versions remained available for download when the security findings were published, meaning new installations were still possible at that point.

The store descriptions promoted features such as ad-free viewing, access to region-restricted content, and support for 1080p streams where that quality would otherwise be unavailable. They did not disclose that authenticated Twitch traffic would pass through infrastructure controlled by the extension’s operator.

Playlist interception exposed live bearer credentials

The extension works by intercepting Twitch video-playlist requests sent to usher.ttvnw[.]net. Instead of allowing those requests to travel directly to Twitch’s delivery infrastructure, it redirects them through external proxy servers.

That architecture alone creates a significant trust dependency. In current v85.x releases, however, the extension also extracts the viewer’s Twitch OAuth token and appends it to the redirected URL using the &auth= query parameter.

As a result, the token is sent to the proxy whenever the user watches a channel covered by the forwarding logic. Because the credential is embedded in the URL, conventional proxy request logging can record it in plaintext.

This is not limited to a one-time installation or authentication event. An affected installation can transmit the live token repeatedly as the user opens eligible Twitch streams. Updating or disabling the extension stops future forwarding, but it cannot retrieve credentials already stored in remote logs or other backend systems.

Earlier v4.x releases used another collection mechanism. Version 4.8, identified as dating to January 2026, submitted the token through an HTTP POST request to an operator-hosted set-token endpoint. It also included fallback infrastructure on deno.dev and deno.net.

Security researcher Kush Pandya of Socket documented the token handling and selective channel exclusions.

Ten channels were excluded from token forwarding

The v85.x code contains exceptions for ten specific Twitch channels. Users watching those channels did not have their tokens sent through the same proxy path:

• pch3lk1n — 580,000 followers
• fasoollka — 361,000 followers
• flamie — 132,000 followers
• dosia — 29 followers
• fander — 2 followers
• almazer — 4 followers
• forzorezor — 177,000 followers
• akyuliych — 1.1 million followers
• lagoda1337 — 225,000 followers
• lagoda — 77,300 followers

Most are Russian-language streamers. The reason for protecting these particular channels has not been established, and the list ranges from accounts with only a handful of followers to one with more than one million.

For every other channel, the extension routed the viewer’s authenticated playlist request through the proxy and included the OAuth credential. The hard-coded exceptions demonstrate that token forwarding was selective and controlled in code rather than an unavoidable consequence of Twitch playlist retrieval.

A stolen token can provide account access without the password

The exposed value is a bearer credential for an authenticated Twitch session. It is therefore considerably more sensitive than a device identifier, browser preference, or ordinary telemetry field.

Anyone possessing a valid token may be able to act through the associated account without entering its password or completing an additional authentication challenge. The exact actions available depend on the session and permissions attached to the token.

Potential consequences include:

• Reading or sending Twitch whispers, including private conversations
• Posting messages under the victim’s identity
• Accessing account settings
• Spending accumulated channel points
• Performing other operations authorized for the active session

A valid token does not need to reveal the underlying password to be useful. It represents an already authenticated state, which is why changing or protecting the password alone may not neutralize an exposed session.

The repeated transmission model increases the risk. Even if one logged copy expires, continued use of an uncorrected extension could send a newer live token when the viewer watches another channel.

There is no confirmed public account of the captured credentials being used to hijack Twitch accounts. However, the ability to collect nearly 31,000 authenticated sessions, combined with possible plaintext proxy logs, creates a direct path to account abuse.

Infrastructure is linked to the JeetBot service

The proxy systems are associated with JeetBot, which markets automation and audience-interaction features for Twitch, Kick, and VK Live. Advertised functions include text-to-speech for messages, automated translation, and other tools for interacting with viewers.

JeetBot claims more than 26,000 active streamers and one billion processed messages. It reportedly holds broad Twitch host permissions and relays authenticated live sessions through its own infrastructure.

The service website’s footer names Aleksandr Popov, a developer based in Cyprus, as the operator. Popov’s LinkedIn profile describes JeetBot as a personal project.

Those connections identify the service associated with the infrastructure, but additional comment from the developer was not available in the published findings. The ultimate retention period for proxy logs, the number of tokens still valid, and whether third parties accessed the collected credentials are not known.

Firefox users can update, while Chrome users should disable the extension

JeetBot’s documentation now says that Firefox version 85.8.7 changes the playlist retrieval process so Twitch OAuth tokens are no longer sent to its proxy servers. Firefox users should verify that they are running 85.8.7 or later.

The equivalent corrected Chrome build was still under review when the issue was reported. Chrome users unable to obtain a fixed release should disable or remove the extension immediately. Existing installations continue forwarding credentials until they are updated or deactivated.

Users should check for these extension identifiers:

• Chrome: pnhhdhhcadcjfckjhpmjneldiegbojfb
• Firefox: [email protected]

Installing the patched version does not invalidate tokens already transmitted. Anyone who used the extension should treat the associated Twitch session as potentially compromised and revoke or rotate relevant Twitch authorization through the account’s available security controls.

Users should also review their accounts for unfamiliar chat messages, whispers, settings changes, or channel-point activity. Any unexplained authenticated action may indicate misuse, although an absence of visible activity does not prove that a token was never collected.

The immediate priorities are straightforward: stop the extension from transmitting additional data, install a corrected release where available, and invalidate previously exposed Twitch sessions.