Malicious Twitch Extension Leaks OAuth Tokens From Nearly 31,000 Users

September 14, 2026 at 12:24 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A malicious Twitch browser extension named “Twitch Enhanced Viewer | JeetBot” leaked OAuth tokens from nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, available on Chrome and Firefox, forwarded tokens for every channel watched except a hardcoded allowlist of ten Russian streamer channels. The tokens were sent as cleartext query parameters, exposing chat, whispers, and account settings.

Key Facts

The extension “Twitch Enhanced Viewer | JeetBot” has 30,000 users on Chrome and 604 on Firefox.
Current builds v85.x forward the OAuth token as an &auth= query parameter to the operator’s proxy for every channel except ten hardcoded Russian streamer channels.
The operator is a commercial Twitch, Kick, and VK-Live bot SaaS with broad Twitch host permissions.
Earlier v4.x builds POSTed the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net.
JeetBot claims over 26,000 active streamers and 1 billion processed messages.

Extension Details

The extension lists HISHIMIRO/jeetbot.cc as its developer and is published on the Chrome Web Store and Mozilla Firefox Add-Ons store. The Chrome version has 30,000 users and was published on June 26, 2025; the Firefox version has 604 users and was published on July 7, 2025. The extension description states: “JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control,” and claims it “expands Twitch capabilities: 1080p stream for regions with constraints.”

Token Leak Mechanism

Socket security researcher Kush Pandya said current builds v85.x forward the token inline as an &auth= query parameter on a network-layer redirect to the operator’s proxy. The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels whose sessions are exempted from forwarding. The extension routes Twitch’s video-playlist requests to “usher.ttvnw[.]net” through operator-controlled proxy servers along with the user’s OAuth token as an “&auth=” query parameter. Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs.

Exempted Channels

The token redirection mechanism is excluded for a hard-coded list of 10 Twitch channels, most of them Russian-language streamers. The list includes pch3lk1n (580K followers), fasoollka (361K), flamie (132K), dosia (29), fander (2), almazer (4), forzorezor (177K), akyuliych (1.1M), lagoda1337 (225K), and lagoda (77.3K). For every channel outside this list, the user’s live token is forwarded to the proxy.