Malicious Twitch Extension Leaks OAuth Tokens of 31,000 Users to Russian Bot Service

A malicious browser extension targeting Twitch users has leaked the OAuth session tokens of approximately 31,000 people, exposing them to potential account hijacking. The tool, distributed through official marketplaces, forwarded sensitive authentication data to proxy servers operated by a Russian commercial bot service.

Marketed as "Twitch Enhanced Viewer | JeetBot," the extension lured users by promising quality-of-life improvements, including ad-blocking, region-unlocking for streams, and the ability to force 1080p or 2K resolutions. According to research from Socket, the extension exfiltrated tokens via a network-layer redirect, appending the stolen data as an "&auth=" query parameter in cleartext requests to the operator's proxy servers. The breach affected over 30,000 Chrome users and more than 500 Firefox users.

The Infrastructure of JeetBot

The threat actor has been identified as JeetBot, which is suspected to be a Russian commercial Software-as-a-Service (SaaS) provider specializing in bots for platforms including Twitch, Kick, and VK-Live. By leveraging the trust associated with the Chrome Web Store and Firefox Add-ons store, the operators were able to distribute their payload to a wide audience. The Socket Threat Research Team noted that the operator is a commercial bot service that maintains broad Twitch host permissions to relay live authenticated sessions through its own infrastructure.

Why OAuth Theft Matters

This incident underscores a critical vulnerability in how users trust browser extensions. Because OAuth tokens provide direct access to account functionality without requiring a password, the theft of these tokens allows attackers to effectively hijack a user's identity. With these authenticated sessions, the operators could potentially read private whispers, send chat messages, and spend account points, all while bypassing standard login security.

The Broader Risk

Security experts highlight the danger of "cross-store" malicious extensions that manage to bypass initial screenings by multiple browser vendors. This case demonstrates how professional botting infrastructures are now integrating credential harvesting to power their commercial operations. Users are encouraged to audit their installed extensions and revoke any suspicious permissions to mitigate the risk of session hijacking.