About 31,000 Twitch users had live OAuth session tokens forwarded to proxy servers operated by a Russian commercial bot service, according to research published by Socket on September 11.
Scope and distribution: Twitches of a single extension
The extension at the center of Socket’s report is listed as Twitch Enhanced Viewer | JeetBot and was available on both the Chrome Web Store and Firefox Add-ons when Socket published its findings. Socket reported roughly 30,000 Chrome users and 552 Firefox users. The listings were still live at the time Socket’s research was published.
Technique: OAuth tokens appended to proxied requests
Socket found the extension routed Twitch video-playlist requests through JeetBot proxy servers. The user’s OAuth token was appended as a URL query parameter on those redirects, which causes the token to be written in cleartext into the proxy’s request logs.
Socket said the token sent is the account-scoped Twitch token rather than a narrow playback token, and demonstrated that by sending the same value to Twitch’s validation endpoint. Socket noted that “that credential is a bearer token,” and whoever possesses it can read and send whispers, post in chat and spend channel points on the account—without requiring a password or second-factor authentication.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEvolution of the extension: versions and exfiltration mechanisms
Socket’s timeline shows an evolution in how captured tokens were handled. Version 4.x builds went further: Socket reported version 4.8, from January 2026, posted captured tokens to a dedicated set-token endpoint on JeetBot infrastructure and backed them up to two Deno services. Those builds tracked the last token sent and applied a five-second cooldown—behavior Socket said only makes sense if the receiving server was keeping them. Socket also found Russian-language comments in the code instructing the extension to fail silently if a token send did not succeed.
Later builds removed the set-token endpoints. Socket noted a version-number jump from 7.2.6 in April to 85.2.2 in May, the point at which inline forwarding of the account-scoped token appeared.
Claims versus behavior: store listings and privacy statements
Neither the Chrome Web Store data-safety section nor the extension’s privacy policy disclose the observed behavior. Socket reported the Chrome Web Store data-safety section states the developer will not collect or use user data and does not sell it to third parties; the linked privacy policy, Socket said, claims the extension does not collect, store or process any user data. Socket’s findings contradict those public claims.
What this means for Twitch users, security teams, and platform operators (Google, Mozilla, Twitch)
- Twitch users: Socket advised users to remove the extension, then disconnect all sessions in Twitch account settings and re-authenticate; doing so invalidates any forwarded token, Socket said.
- Security teams and technologists: Socket told security teams to treat browser extensions that hold host permissions over an authenticated service combined with a third-party proxy destination as a credential-exposure risk.
- Google, Mozilla and Twitch: Socket said these organizations were approached for comment; this article will be updated with any response. The extension remained listed on both stores when Socket published its research.
Socket’s report ties a high-impact credential-exposure technique—forwarding account-scoped OAuth tokens in URL query parameters—to a cross-store extension with tens of thousands of users. The record of earlier builds that posted tokens to dedicated endpoints, the five-second cooldown and the code comments all point to deliberate handling of captured credentials, Socket said. For now, the concrete remediation steps Socket issued—remove the extension and disconnect sessions—are the immediate actions available to affected users. This story will be updated if Google, Mozilla or Twitch respond to requests for comment.
Original reporting: https://www.infosecurity-magazine.com/news/malicious-twitch-extension-oauth/
