--- title: Malicious Twitch Browser Extension Exposes 30,000 Users’... description: A Chrome and Firefox extension called "Twitch Enhanced Viewer | JeetBot," installed by roughly 31,000 users, secretly forwards users' live Twitch OAuth session... canonical: https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service | daily.dev og:description: A Chrome and Firefox extension called "Twitch Enhanced Viewer | JeetBot," installed by roughly 31,000 users, secretly forwards users' live Twitch OAuth session... og:url: https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj og:image: https://api.daily.dev/og/posts/4RXGf2dtJ.png og:image:alt: Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service **[Socket](https://daily.dev/sources/socketdev)** · 8 min read · 1 upvotes · 0 comments ## Summary A Chrome and Firefox extension called "Twitch Enhanced Viewer | JeetBot," installed by roughly 31,000 users, secretly forwards users' live Twitch OAuth session tokens to proxy servers run by a Russian commercial Twitch/Kick/VK-Live bot service. The extension markets itself as an ad-blocker and quality-of-life tool, but while redirecting video-playlist requests through operator proxies it appends the full account-scoped OAuth token as a URL query parameter, logged in cleartext, except for ten hardcoded Russian-language streamer channels that are exempted. Earlier v4.x builds (through January 2026) POSTed tokens directly to dedicated collection endpoints with rate-limiting logic, indicating server-side token storage; that endpoint was later removed in favor of the inline forwarding still present in the current v85.x builds. The token grants full account access—chat, whispers, settings—far beyond what video playback requires, and the exposure contradicts both the Chrome Web Store's data-safety claims and the developer's own privacy policy. Socket attributes the operator to a JeetBot identity tied to specific infrastructure hosts and provides IOCs, MITRE ATT&CK mappings, and remediation steps including removing the extension and re-authenticating Twitch sessions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the Twitch Enhanced Viewer JeetBot browser extension actually do with my OAuth token? It captures your live Twitch OAuth session token from the Authorization header and forwards it as an &auth= query parameter when redirecting video-playlist requests through operator-controlled proxy servers, exempting only ten hardcoded Russian-language streamer channels. This token grants full account access, including chat, whispers, and settings, not just video playback, and is logged in cleartext on the proxy server. _Anyone auditing extension permissions before installing should check how daily.dev surfaces credential-exfiltration research like this._ ### How many users were affected by the malicious Twitch Enhanced Viewer extension? Roughly 31,000 users across both stores were affected: about 30,000 on the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb) and 552 on Firefox Add-ons (twitchenhancedviewer@example.com). Both listings remained live at time of disclosure, and the exposure was undisclosed in either store's data-safety information. _Track incidents like this on daily.dev to gauge real-world blast radius before recommending extensions to a team._ ### What should I do if I installed a malicious browser extension that stole my Twitch OAuth token? Remove the extension immediately, then go to Twitch account settings and disconnect all sessions to re-authenticate, which invalidates any forwarded token. Treat any extension that proxies traffic for a logged-in service as having access to that service's session credentials, since a bearer OAuth token lets an attacker act on the account without the password or a second factor. _Developers hardening incident response playbooks can follow security writeups like this on daily.dev._ ## Similar posts on daily.dev - [Over 100 Chrome extensions in Web Store target users accounts and data](https://daily.dev/posts/over-100-chrome-extensions-in-web-store-target-users-accounts-and-data-qecpawyca) · BleepingComputer · 1 upvotes · 0 comments - [108 Chrome Extensions Linked to Data Exfiltration and Sessio...](https://daily.dev/posts/108-chrome-extensions-linked-to-data-exfiltration-and-sessio--r4tdhhzt9) · Socket · 4 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#oauth](https://daily.dev/tags/oauth), [#twitch](https://daily.dev/tags/twitch) [View this post on daily.dev](https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service","url":"https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj"},"datePublished":"2026-09-11T16:24:41.510Z","dateModified":"2026-09-11T16:44:54.497Z","description":"A Chrome and Firefox extension called \"Twitch Enhanced Viewer | JeetBot,\" installed by roughly 31,000 users, secretly forwards users' live Twitch OAuth session...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e0bb2e2dcfeac06ded53e1e958b51af?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e0bb2e2dcfeac06ded53e1e958b51af?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,oauth,twitch","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-twitch-browser-extension-exposes-30-000-users-oauth-tokens-to-russian-bot-service-4rxgf2dtj#faq","mainEntity":[{"@type":"Question","name":"What does the Twitch Enhanced Viewer JeetBot browser extension actually do with my OAuth token?","acceptedAnswer":{"@type":"Answer","text":"It captures your live Twitch OAuth session token from the Authorization header and forwards it as an &auth= query parameter when redirecting video-playlist requests through operator-controlled proxy servers, exempting only ten hardcoded Russian-language streamer channels. This token grants full account access, including chat, whispers, and settings, not just video playback, and is logged in cleartext on the proxy server. Anyone auditing extension permissions before installing should check how daily.dev surfaces credential-exfiltration research like this."}},{"@type":"Question","name":"How many users were affected by the malicious Twitch Enhanced Viewer extension?","acceptedAnswer":{"@type":"Answer","text":"Roughly 31,000 users across both stores were affected: about 30,000 on the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb) and 552 on Firefox Add-ons (twitchenhancedviewer@example.com). Both listings remained live at time of disclosure, and the exposure was undisclosed in either store's data-safety information. Track incidents like this on daily.dev to gauge real-world blast radius before recommending extensions to a team."}},{"@type":"Question","name":"What should I do if I installed a malicious browser extension that stole my Twitch OAuth token?","acceptedAnswer":{"@type":"Answer","text":"Remove the extension immediately, then go to Twitch account settings and disconnect all sessions to re-authenticate, which invalidates any forwarded token. Treat any extension that proxies traffic for a logged-in service as having access to that service's session credentials, since a bearer OAuth token lets an attacker act on the account without the password or a second factor. Developers hardening incident response playbooks can follow security writeups like this on daily.dev."}}]} ```