A malicious browser extension forwarded live session credentials from roughly 31,000 Twitch users to proxy servers operated by a Russian commercial bot service, according to research published by Socket on September 11. The cross-platform extension, marketed as Twitch Enhanced Viewer | JeetBot, was still available on both the Chrome Web Store and Firefox Add-ons at the time Socket released its findings. The extension promised ad blocking, forced 1080p streaming, and region unlocking but secretly captured account-scoped OAuth tokens that grant broad access to user accounts.
The extension had attracted approximately 30,000 users on Chrome and 552 on Firefox when Socket analyzed it. Socket discovered that the tool rerouted Twitch video-playlist requests through JeetBot proxy servers and attached each user's OAuth token as a URL query parameter, exposing it in plaintext within the proxy's request logs. Earlier versions went further: build 4.8 from January 2026 transmitted captured tokens to a dedicated set-token endpoint on JeetBot infrastructure, with redundant backups hosted on two Deno services. Those builds tracked the most recent token transmitted and enforced a five-second cooldown between sends. The version numbering jumped from 7.2.6 in April to 85.2.2 in May, when the inline forwarding mechanism appeared.
Socket demonstrated that the stolen credential is the account-scoped Twitch token rather than the narrow playback token, proving it by showing the extension transmits the identical value to Twitch's own validation endpoint. That bearer token allows anyone holding it to read and send whispers, post in chat, and spend channel points on the account without requiring a password or second-factor authentication. The report notes the extension's strongest indicator of malicious intent is that it doesn't require the token to function—it already processes the playback token separately, and for a hardcoded list of 10 Russian-language streamer channels, it routes traffic through the same proxy with no account token attached. None of this data collection is disclosed in the extension's privacy documentation, which states the developer will not collect or use user data and does not sell it to third parties.
The stolen tokens pose a credential-exposure risk because bearer tokens function as master keys that bypass standard authentication safeguards. Socket explained that earlier builds stored captured tokens by posting them to dedicated endpoints, with Russian-language code comments instructing the extension to fail silently if a token transmission didn't succeed—behavior that only makes sense if the receiving server was preserving them for future use. Socket advised users to remove the extension immediately, then disconnect all sessions in Twitch account settings and re-authenticate to invalidate any forwarded tokens. The security firm also told security teams to treat browser extensions with host permissions over an authenticated service, combined with third-party proxy destinations, as a credential-exposure risk. Twitch confirmed on September 14 that it's aware of reports involving a third-party browser extension potentially affecting account security and recommended users remove suspicious extensions and review third-party connections.
Users who installed the extension believing they were gaining convenience features unknowingly handed over keys to their entire Twitch identity, a trade-off few would accept if presented transparently. Security leaders weighing risk should recognize that even modest quality-of-life tools can become vectors when permissions and routing architecture create opportunities for silent credential harvesting.