A malicious browser extension targeting Twitch users has exfiltrated OAuth authentication tokens from approximately 31,000 accounts to infrastructure controlled by a Russian commercial bot service.
The compromised extension, marketed as "Twitch Enhanced Viewer | JeetBot," was distributed across both Google Chrome and Mozilla Firefox add-on stores. The extension lists HISHIMIRO/jeetbot.cc as its developer and successfully harvested OAuth tokens before security researchers detected and removed it from official distribution channels.
OAuth tokens represent a critical security asset in the Twitch ecosystem. These tokens grant applications delegated access to user accounts without exposing passwords directly. An attacker holding valid OAuth tokens can perform authenticated actions on behalf of a victim, including accessing account settings, viewing private information, making purchases, modifying stream settings, and broadcasting content from compromised channels.
The tokens were transmitted to proxy servers operated by a Russian commercial botnet service. This infrastructure typically monetizes stolen credentials through account takeover schemes, credential sales on darknet markets, or integration into larger fraud operations targeting streaming platforms and their user bases.
The attack mechanism relied on social engineering rather than technical exploitation. Users downloaded the extension believing it offered legitimate Twitch viewer enhancements. Once installed, the extension silently captured OAuth tokens generated during normal Twitch authentication flows and forwarded them to attacker-controlled servers. The extension's presence in official app stores provided credibility and reached a substantially larger user population than a direct distribution campaign would achieve.
This incident reflects a persistent vulnerability in browser extension ecosystems. Both Chrome Web Store and Firefox Add-Ons require review processes before publication, but malicious submissions frequently bypass detection by obscuring malicious behavior, using obfuscated code, or deploying functionality that only activates after initial approval and distribution.
For affected Twitch users, the immediate remediation involves revoking compromised OAuth tokens through account security settings. Twitch users should navigate to their security dashboard, review connected applications and devices, and revoke any unfamiliar or suspicious connections. Users who installed this extension should change their Twitch password immediately, enable two-factor authentication if not already active, and monitor account activity for unauthorized changes.
Organizations operating Twitch channels face elevated risk if multiple team members or moderators installed the extension. Attackers could use stolen tokens to alter channel settings, modify moderation rules, inject malicious content into streams, or spam followers with phishing links.
The distribution across multiple platforms demonstrates how threat actors exploit the fragmented nature of browser extension marketplaces. While individual app store reviews may catch obvious malicious code, sophisticated submissions that defer activation or hide functionality behind legitimate-appearing features often escape detection.
Twitch has not issued formal guidance regarding this incident, though affected users report notifications from the platform regarding unauthorized access attempts on their accounts. Browser users should adopt a strict policy regarding extension installations, limiting downloads to extensions from established developers with verifiable track records and extensive user reviews. Extensions requesting excessive permissions, particularly those requesting broad data access or network permissions, warrant additional scrutiny before installation.