Tag: oauth tokens
6 articles
Twitch Extension Exposes Users' OAuth Tokens
A popular browser extension with over 30,000 installs, marketed as Twitch Enhanced Viewer | JeetBot, has been found to be secretly forwarding users' sensitive Twitch OAuth session tokens to a third-party bot service. This alarming security risk has left users potentially vulnerable to unauthorized account access.
Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens
A malicious Twitch extension, known as Twitch Enhanced Viewer | JeetBot, has compromised the live OAuth session tokens of approximately 31,000 users, forwarding them to Russian proxy servers. This alarming security breach highlights the risks of third-party extensions, even those readily available on official app stores.
Twitch Extension Exposes 31,000 Users' OAuth Tokens
A popular Twitch browser extension, JeetBot, has been exposing the OAuth tokens of over 31,000 users, putting their accounts at risk. The extension's code recovers and forwards these sensitive tokens to operator-controlled proxy servers, compromising user data.
ShinyHunters Targets Healthcare with Rising Data Theft Attacks
ShinyHunters is on the hunt, using data theft at cloud scale to target healthcare and medical-tech organizations, leveraging stolen OAuth tokens and corporate single-sign-on accounts to wreak havoc. This notorious extortion gang has successfully breached numerous organizations in the past two years, often through clever social engineering tactics.
LastPass Breach Exposes Customer Data in Supply Chain Hack
LastPass recently discovered a security incident at Klue, a third-party platform they use, which led to an unauthorized actor accessing some customer data through its Salesforce environment. Fortunately, customer vaults and core products remain secure, and swift action has been taken to mitigate the breach.
GitHub Dev Attack Exploits OAuth Tokens
A single click can be all it takes for an attacker to swipe a GitHub token, giving them free rein to read and write to your private repos. Security researcher Ammar Askar warns that a clever exploit in GitHub.dev's web-based editor can turn a harmless link into a token-stealing threat.