As reported by The Hacker News, a cross-store browser extension operating under the name "Twitch Enhanced Viewer | JeetBot" has been exfiltrating Twitch OAuth tokens from approximately 31,000 users across Chrome and Firefox to proxy servers controlled by a Russian commercial bot service. The extension, still live on both major browser stores as of this reporting, masquerades as a quality-of-life tool for stream region-unlocking — and that dual-use premise is precisely what makes it effective.

Threat Alert: Users who reused Twitch credentials across services, or whose Twitch account is linked to payment methods for subscriptions or bits, face elevated risk.

Why This Matters Beyond Twitch

This incident is not a Twitch platform vulnerability. It is a browser extension supply chain failure with downstream identity exposure. The extension held OAuth tokens that grant access to chat, private whispers, and account settings — and it forwarded those tokens as cleartext URL parameters to operator-controlled infrastructure. Anytime a credential lands in a query string, it is written to server access logs, CDN edge logs, and potentially intermediary proxies. That token is now part of the operator's log corpus indefinitely.

The broader concern is the permission model itself. Browser extensions that request host permissions for high-value domains (twitch.tv, google.com, github.com) operate with deep access to authenticated sessions. Store review processes — both Chrome Web Store and Mozilla AMO — remain insufficient at detecting intent-based abuse, especially when the extension's overt functionality is genuine. JeetBot appears to actually deliver region-unlocked streams; the theft is a side channel layered on top of legitimate behavior, which is a classic supply-chain adversary pattern.

Technical Mechanics Worth Noting

  • Token capture: The extension recovers the Twitch OAuth token from the authenticated session and appends it as an &auth= query parameter on network-layer redirects to operator proxies.
  • Proxy routing: Video-playlist requests to usher.ttvnw.net are rerouted through attacker infrastructure, giving the operator visibility into live authenticated session traffic — not just the token.
  • Hardcoded exemption list: Ten Russian-language streamer channels are explicitly excluded from token forwarding. This is a notable operational security signal — the operator is protecting a domestic audience while harvesting foreign users, a pattern consistent with Russian cybercriminal monetization operations.
  • Version evolution: Earlier v4.x builds POSTed tokens to a dedicated set-token endpoint with deno.dev and deno.net backups, indicating iterative development and infrastructure redundancy.
Key takeaway: The attacker does not need a zero-day when users voluntarily install a tool that holds their session token. Social engineering via store listings remains the highest-ROI entry vector in the browser ecosystem.

Who Is Affected

Any user who installed the Chrome extension (ID: pnhhdhhcadcjfckjhpmjneldiegbojfb, ~30,000 users) or Firefox add-on (~604 users) has had their Twitch OAuth token exposed. Affected tokens remain valid until rotated or the session expires. Users who reused Twitch credentials across services, or whose Twitch account is linked to payment methods for subscriptions or bits, face elevated risk.

Shield53 Recommendations

  • Immediate: Remove the extension from all managed and personal browsers. Audit endpoint management tooling for presence of the Chrome ID and Firefox add-on email.
  • Rotate OAuth sessions: Instruct affected users to sign out of all Twitch sessions via Account Settings → Connections, then force a password change and revoke all authorized apps and extensions.
  • Enable 2FA: Require TOTP-based 2FA on all Twitch accounts in your organization's streaming or marketing surfaces.
  • Hunt for lateral tokens: If affected users logged into Twitch via SSO or linked accounts, review OAuth grants on Google, Discord, Steam, and any identity provider connected to Twitch.
  • Block at the perimeter: Add jeetbot.cc, the deno.dev/deno.net backup endpoints, and operator proxy domains to your DNS blocklists and proxy egress filters.
  • Extension governance: For enterprise teams, deploy Chrome Enterprise policies restricting extension installation to an allowlist. Block extensions that request *://*.twitch.tv/* host permissions unless business-justified.
  • Detection: Search browser history and proxy logs for &auth= parameters appended to ttvnw.net or jeetbot domains to identify impacted users retroactively.

The browser extension economy remains one of the least-governed attack surfaces in enterprise security. Until store reviews catch intent-based abuse — which is unlikely in the near term — the burden falls on defenders to treat every installed extension as untrusted code with credential access. JeetBot will not be the last instance of this pattern; it will simply be the one that reminds the industry to act.