Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

On September 11, 2026, Socket’s threat research team revealed that a browser extension popular with Twitch viewers, “Twitch Enhanced Viewer | JeetBot”, was sending its users’ OAuth tokens to proxies run by a commercial Russian-language bot service. Around 31,000 installations across Chrome and Firefox were affected. The token travelled in cleartext inside request URLs, and therefore landed in third-party server logs. Beyond Twitch, the case shows a very concrete risk for businesses: a “quality-of-life” extension can expose session credentials without a single password being stolen.

What happened

The extension was distributed through the Chrome Web Store and Firefox Add-ons. JeetBot, the service behind it, is a commercial Russian-language bot SaaS for Twitch, Kick and VK Live. Socket, a software supply chain security firm, analyzed its code and published its findings on September 11, 2026, followed by updates on September 16 and 25 after the developer responded.

The core finding: for any Twitch channel, the video playback request was redirected to an operator-controlled proxy, with the user’s OAuth token appended as a URL parameter. There was one telling exception. For a hardcoded list of ten Russian-language streamer channels, traffic went through the same proxy without the token. For Socket, this proves the token was not required for the service to function.

Technical analysis

How the token was captured and forwarded

Based on Socket’s analysis, the chain worked as follows:

• a content script read the Authorization header used by Twitch, along with the device ID, and passed them to the extension’s background worker;
• the worker extracted the raw OAuth token and validated it against Twitch’s validation endpoint;
• video requests to usher.ttvnw.net were redirected to the operator’s proxy, with the token added in an &auth= parameter;
• sitting in the query string, the token showed up in cleartext in the proxy’s logs.

The mechanism was identical on both browsers: a blocking webRequest listener on Firefox and a declarativeNetRequest regex substitution rule on Chrome. The operator’s server decided dynamically which proxy received the traffic.

Earlier versions were more direct

The 4.x builds (for example 4.8, from January 2026) went further: a module explicitly POSTed the token to a set-token endpoint on the operator’s infrastructure, with fallback servers hosted on Deno. Send errors were silently ignored, and a cooldown mechanism avoided repeated sends, which Socket says implies server-side token storage. Those endpoints were later decommissioned and no longer appear in recent builds.

Why this token matters

This is not a narrow playback token: it is scoped to the account. According to Socket, whoever holds it can read and send whispers, post in chat, access account settings and spend channel points, without knowing the password and without triggering a second factor. That is precisely what makes this kind of leak dangerous: strong authentication is bypassed because the session already exists.

Who is affected?

Directly: users who installed a version earlier than 85.8.7 (Firefox) or 85.8.9 (Chrome). Indirectly: any organization that lets employees freely install extensions on browsers also used for business services, including marketing or communications teams managing streaming accounts, content creators, and any workstation where a broadly permissioned extension can see authentication headers.

Why it matters for your organization

Browser extensions can reach extremely sensitive data: authentication headers, session cookies, page content. An extension that routes traffic through a third-party proxy can harvest access tokens for SaaS applications, with no classic malware and no antivirus alert. Store privacy disclosures are no guarantee: in this case, they explicitly claimed that no data was collected.

The risk is even harder to spot because extension updates are automatic: an extension that was harmless when installed can change behavior months later.

MITRE ATT&CK mapping

Mapping provided by Socket in its analysis:

Recommendations

1. ImmediateUpdate or remove the extension

   Search your fleet for Chrome ID pnhhdhhcadcjfckjhpmjneldiegbojfb and Firefox ID twitchenhancedviewer@example.com. Flag any version earlier than 85.8.7 (Firefox) or 85.8.9 (Chrome).

2. ImmediateRevoke Twitch sessions

   Affected users should disconnect all Twitch sessions and sign in again to invalidate potentially exposed tokens.

3. Short termEnforce an extension allowlist

   Use Chrome, Edge and Firefox management policies to allow only approved extensions and block free installation on corporate devices.

4. Short termAssess permissions, not descriptions

   Treat any extension with permissions over authenticated domains that also routes traffic to third-party destinations as a credential exposure risk, whatever its marketing says.

5. Medium termInventory and monitor continuously

   Make extension inventory part of asset management, and watch proxy or DNS logs for browser connections to unknown proxy domains.

6. Medium termRaise user awareness

   Explain that a free extension promising to block ads or unlock content may have access to every session open in the browser.