Twitch Enhanced Viewer | JeetBot extension forwards OAuth tokens (~30k Chrome users)
Socket Threat Research (Kush Pandya, 11 September 2026; The Hacker News 14 September) documents cross-store browser extension "Twitch Enhanced Viewer | JeetBot" forwarding live Twitch OAuth session tokens to proxies run by a Russian commercial Twitch/Kick/VK-Live bot service. Chrome Web Store ID pnhhdhhcadcjfckjhpmjneldiegbojfb (~30,000 users, published June 2025) and Firefox Add-ons twitchenhancedviewer@example.com (~550–600 users). Current v85.x builds append the token as an &auth= query parameter on redirects toward operator proxies when fetching usher.ttvnw.net playlists (every channel except a hardcoded allowlist of ten mostly Russian-language streamers). Tokens can reach chat, whispers, and account settings and land in cleartext proxy logs. Earlier v4.x builds POSTed tokens to a set-token endpoint. Operator docs later claim Firefox 85.8.7 stops sending tokens to proxies and a Chrome equivalent is under review; users should remove or update the extension and treat Twitch sessions as exposed until credentials are rotated. Distinct from peep-chrome-edge-20260907 and chrome-edge-extensions-superior-20260827. Primary: Socket; secondary: THN.
- Product
- Twitch Enhanced Viewer | JeetBot (Chrome / Firefox browser extension)
- Versions
- Malicious/abusive forwarding in v85.x prior to claimed 85.8.7; earlier v4.x POSTed tokens
- Exploited in Australia?
- unknown
- Patch to
- Remove or update to Firefox 85.8.7+ (Chrome fix under review per operator); revoke Twitch sessions / change password; audit installed Twitch extensions
Primary: Socket — JeetBot Twitch OAuth token forwarding (11 Sep 2026) · Vendor: JeetBot docs (operator fix notice for 85.8.7) · The Hacker News (14 Sep 2026)