Twitch Extension Leaks OAuth Tokens of ~31,000 Users

A new security incident involving the popular streaming platform Twitch has revealed that an unauthorized browser extension was able to harvest and leak OAuth access tokens from almost thirty-one thousand users’ accounts. The compromised data were sent to proxy servers run by a commercial bot service based in Russia, raising immediate concerns over both privacy and potential account takeovers. ¹

The extension—named “Twitch Enhanced Viewer | JeetBot”—was listed on both Google Chrome’s Web Store and Mozilla Firefox Add‑Ons store under the developer handle HISHIMIRO/jeetbot.cc. It appeared as a cross‑store add‑on designed to improve viewing experience but actually injected JavaScript into web pages to intercept user credentials. This technique mirrors earlier malware such as CoinJoinMiner that targeted cryptocurrency exchanges in 2019. ¹

During its operation, the extension captured OAuth tokens associated with each logged‑in Twitch session and forwarded them to a set of proxy endpoints controlled by the Russian bot network. Close to 31,000 distinct user tokens were exfiltrated before detection. These tokens grant full read/write access to the victim’s Twitch account, enabling attackers to perform automated spamming or even hijack other social platforms like YouTube and Discord if they possess additional login information. ¹

Even seemingly benign tools can become credential theft vectors when they request excessive permissions without clear justification. The incident underscores the importance for users to scrutinize the permission requests of any third‑party add‑ons and to keep their browsers updated so that security patches block known malicious patterns. Organizations using Twitch for internal communication should also audit active OAuth tokens and rotate keys where possible. ¹