Twitch extension with 30K installs exposes users’ OAuth tokens

Recorded: Sept. 14, 2026, 7:08 p.m.

Original

News

Featured
Latest

Microsoft: September updates cause RDS failures on Windows Server

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

New Android malware encrypts files, steals data, and harasses victims

Florida confirms DMV database breached via stolen police account

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Hackers target exposed Vite dev servers to steal AWS, Azure secrets

Why Patch Automation Needs Brakes, Not Just an Accelerator

Webinar: How malicious OAuth apps can lead to Google Workspace breaches

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityTwitch extension with 30K installs exposes users’ OAuth tokens

Twitch extension with 30K installs exposes users’ OAuth tokens

By Bill Toulas

September 14, 2026
03:03 PM
0

A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users’ Twitch OAuth session tokens to a commercial bot service.
The extension has more than 30,000 installs and is advertised as a legitimate third-party tool for Twitch that can block ads, force 1080p (full HD) playback, bypass region restrictions, and enable channel-point collection.
However, an analysis from application security company Socket shows that the extension captures the authorization header used by the Twitch web client, extracts the user OAuth token, and sends the credentials through proxy servers.
The servers are operated by JeetBot, a commercial Russian-language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live.
In current versions of the extension, the token is appended directly to redirected proxy requests as an auth= URL parameter, ending up in the proxy server’s request logs, where the software vendor can easily retrieve it.
“When the extension redirects Twitch’s video playlist request (to usher.ttvnw[.]net) through that proxy, it appends the token as an &auth= query parameter,” Socket says.
“Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs.”
This process occurs for every Twitch channel the user watches, except for a set of ten Russian-language channels hardcoded into the extension’s code.

The malicious extension on the Chrome Web StoreSource: BleepingComputer.com
Socket highlights that earlier versions of the extension included more explicit credential-theft mechanisms.
In the description of the product in the Firefox Add-ons store, the developer provided a disclaimer about the previously used mechanism, saying:
“Previous versions of the extension transmit your OAuth-twitch token to our server. This is necessary for the stream to run in 1080/1440p.” [machine translated]
The data privacy disclosure for the Chrome variant of Twitch Enhanced Viewer | JeetBot says that its developer “disclosed that it will not collect or use your data.”
The declaration covers selling user data to third parties except for approved cases, transferring it for reasons outside the product’s “core functionality,” or “to determine creditworthiness or for lending purposes.”
At the time of publishing, the extension was still present in both the Chrome Web Store and the Firefox Add-Ons store.
BleepingComputer has sent JeetBot a request for additional information at the email address indicated in the Chrome Web Store, but we have not received a response by publication.
Socket researchers believe the extension represents a security risk and recommend that users remove it from their browsers, disconnect all sessions in Twitch, and then re-authenticate, to invalidate any token that may have been forwarded.
Developers are advised to avoid routing requests with authentication headers or tokens through third-party servers.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
Chrome Web Store extensions caught stealing crypto, browser dataHundreds of fake Chrome VPN extensions route traffic through a proxyGoogle Chrome may soon block New Tab hijacker extensions by defaultGoogle warns of new Chrome zero-day bug exploited in attacksBigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

Account Takeover
Addons
Browser Extension
Extensions
Firefox
Google Chrome
Token
Twitch

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Popular Stories

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Hackers abused Claude to extract secrets from 1.8M Android apps

GitLab urges users to patch max severity path traversal flaw

Sponsor Posts

Patch automation needs more than speed. Action1 brings control into every stage of deployment.

Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions.

Overdue a password health-check? Audit your Active Directory for free

Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.

EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Upcoming Webinar

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Username

Password

Remember Me

Not a member yet? Register Now

Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

A browser extension named Twitch Enhanced Viewer | JeetBot, which has amassed over thirty thousand installations across the Chrome and Firefox stores, poses a significant security risk by exposing users' OAuth session tokens to a commercial service. The extension is advertised as a legitimate tool for enhancing the Twitch viewing experience, offering functionalities such as ad blocking, forced 1080p playback, region bypassing, and channel-point collection. However, an analysis conducted by application security company Socket revealed that the extension captures the authorization header from the Twitch web client, extracts the user's OAuth token, and transmits these credentials via proxy servers operated by JeetBot, a service specializing in Twitch, Kick, and VK Live tools.

The mechanism for data exfiltration involves appending the extracted token directly to redirected proxy requests using an auth= URL parameter. This process results in the token being written in cleartext within the request logs of the proxy server, allowing the vendor to easily retrieve the sensitive data. This exfiltration process is executed for every Twitch channel the user views, with the exception of ten Russian-language channels that are hardcoded into the extension’s source code. Although earlier versions of the extension incorporated more explicit credential-theft mechanisms, the developer later provided a disclaimer in the Firefox Add-ons store stating that they would not collect or use user data unless it was essential for the core functionality or approved exceptions.

Despite the developer's assurances regarding data usage, Socket researchers concluded that the extension represents a substantial security vulnerability. They advise that users should immediately remove the extension from their browsers, disconnect all active Twitch sessions, and subsequently re-authenticate to invalidate any potentially forwarded tokens. Furthermore, the report cautions that developers should refrain from routing requests containing authentication headers or tokens through third-party servers to mitigate such risks.