{"id":2822,"date":"2026-09-14T09:12:22","date_gmt":"2026-09-14T09:12:22","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2822"},"modified":"2026-09-14T09:12:22","modified_gmt":"2026-09-14T09:12:22","slug":"malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31000-users","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2822","title":{"rendered":"Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 14, 2026<\/span><\/span>Malware \/ Browser Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service.<\/p>\n

The extension, named \u00abTwitch Enhanced Viewer | JeetBot,\u00bb lists HISHIMIRO\/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store –<\/p>\n

Both extensions are still available for download as of writing. The extension listing description states: \u00abJeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control,\u00bb adding it \u00abexpands Twitch capabilities: 1080p stream for regions with constraints.\u00bb<\/p>\n

\u00abCurrent builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator’s proxy,\u00bb Socket security researcher Kush Pandya said<\/a>. \u00abThe token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe operator is a commercial Twitch, Kick, and VK-Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure.\u00bb<\/p>\n

<\/p>\n

While the extension claims to offer an ad-free experience and serve region-unlocked content, it does so by routing Twitch’s video-playlist requests to \u00abusher.ttvnw[.]net\u00bb through operator-controlled proxy servers along with the user’s OAuth token as an \u00ab&auth=\u00bb query parameter.<\/p>\n

Specifically, the add-on embeds code to recover the Twitch OAuth token and send it to the proxy. The token can enable access to a user’s chat, whispers<\/a> (i.e., private messages), and account settings.<\/p>\n

\"\"<\/a><\/div>\n

Given that the token is placed in the URL query string, it gets written in cleartext into the proxy server’s request logs. The token redirection mechanism, however, is excluded for a hard-coded list of 10 Twitch channels, most of them being Russian-language streamers with thousands of followers –<\/p>\n