Author: DigitalSpying Security Desk
Date: September 14, 2026
Executive Summary
A critical identity credential exposure has been uncovered across popular browser extension marketplaces, affecting nearly 31,000 live streaming users. According to technical investigations published by software supply-chain security firm Socket and reported by The Hacker News, a cross-browser extension named "Twitch Enhanced Viewer | JeetBot"—available on both the Google Chrome Web Store and Mozilla Firefox Add-Ons repository—has been transmitting users' live Twitch OAuth bearer tokens directly to third-party proxy servers operated by a commercial bot service.
Under the guise of providing region-unlocked 1080p stream access and ad-blocking, the extension intercepted video playlist queries and forwarded active session tokens as cleartext URL query parameters. Because OAuth bearer credentials grant complete API access to accounts—including private direct messages (whispers), authenticated chat posting, and channel point transactions—the incident highlights severe browser extension permission risks and third-party credential leakage.
Deep-Dive Technical Analysis
1. The Anatomy of the Exfiltration Primitive
The JeetBot extension advertised stream enhancements for viewers facing bandwidth or regional constraints. The technical indicators of the malicious behavior are detailed below:
Asset Identifier
Chrome Web Store ID
Firefox Add-on ID
Install Base
Twitch Enhanced Viewer
pnhhdhhcadcjfckjhpmjneldiegbojfb
twitchenhancedviewer@example.com
>30,000
Network-Layer Interception & Token Harvesting
* The Core Hook: The extension registers broad web request interception permissions over Twitch domains (*://*.twitch.tv/* and usher.ttvnw.net).
* Query Parameter Exposure: When a viewer loads a live broadcast, the extension intercepts requests to Twitch's playlist routing service (usher.ttvnw.net). Rather than allowing direct browser-to-Twitch communication, the extension reroutes the video playlist request through an operator-controlled proxy network.
* Cleartext Token Forwarding: In doing so, the extension extracts the user's active Twitch OAuth session token and appends it inline as an &auth= query parameter in the redirected URL request: https://proxy.operator-domain[.]com/api/playlist?channel=...&auth=oauth:xxxxxxxxxxxxxxxxxxxxxx
* Logging Risks: Because the token is embedded in the HTTP GET query string, it is automatically recorded in cleartext within web server access logs, reverse proxy buffers, and third-party transit caches across the operator's infrastructure.
JEETBOT TOKEN EXFILTRATION PIPELINE
1. User Action: Navigates to a Live Twitch Stream.
2. Request Generation: Browser generates Video Playlist Request to usher.ttvnw.net.
3. Interception: JeetBot Subsystem intercepts the Web Request via chrome.webRequest API.
4. Extraction: Extension extracts the user's active Twitch OAuth Bearer Token.
5. Redirect: Request is redirected to the Operator Proxy with the &auth= parameter appended.
6. Compromise: Bearer credential grants full account impersonation (Whispers, Chat, Points, Settings).
2. The Curious Exemption Allowlist
Forensic examination of the extension's codebase revealed a striking anomaly: token forwarding was suppressed for an explicit allowlist of ten Russian-language streamer channels.
Exempted Russian Channel
Follower Count
akyuliych
1.1 Million
pch3lk1n
580,000
fasoollka
361,000
flamie
132,000
For every channel outside this list, the user’s live bearer token was systematically forwarded to the external proxy. While the developer claimed this distinction originated from a legacy playback workaround designed to bypass geographic proxy detection errors, security analysts emphasize that routing bearer tokens to external servers is fundamentally insecure regardless of intent.
3. Historical Evolution & Infrastructure Backends
Socket's historical code analysis indicates that token extraction has been active across multiple versions:
* Version 4.x Builds (Early 2026): Dispatched tokens via explicit HTTP POST requests to dedicated set-token endpoints hosted on Deno deploy instances (deno.dev and deno.net).
* Version 85.x Builds: Transitioned to inline query parameter redirection on playlist fetch requests.
* Operator Attribution: The backend infrastructure is tied to JeetBot, a commercial automation and chatbot service operating across Twitch, Kick, and VK Live boasting over 26,000 registered streamers.
Security Impact: The Danger of OAuth Bearer Credential Exposure
* Bearer Credential Mechanics: In the OAuth 2.0 protocol model, bearer tokens function like digital cash; any entity possessing the token can present it to Twitch API endpoints and act with the authorized scopes of that user.
* Authentication Bypass: Holding a bearer token completely bypasses Multi-Factor Authentication (MFA) and eliminates the need for passwords.
* Compromised Capabilities:
* Reading and sending private messages (whispers).
* Impersonating the user in live chat rooms.
* Modifying stream keys, account preferences, and spending channel points.
* The Persistence Problem: Even if the developer patches the extension or the user uninstalls it, previously exposed tokens remain completely valid on Twitch's servers until explicitly revoked by the user or expired by the provider.
Actionable Recommendations & Remediation Checklist
1. Immediate Token Revocation for Twitch Users
Updating or deleting the browser extension does not invalidate already leaked credentials. Impacted users must manually revoke active session grants:
* Log in to Twitch.tv and navigate to Settings -> Connections.
* Scroll to the Other Connections section.
* Review all authorized third-party applications and click Disconnect on any unfamiliar or unverified tools, including JeetBot and third-party stream enhancers.
* Reset your account password, which automatically triggers global session and OAuth token invalidation.
2. Enterprise Browser Extension Governance
Enterprise IT environments must treat browser extensions as significant shadow-IT identity risks:
* Enforce Extension Whitelisting: Use Google Chrome Enterprise policies and Intune/Group Policy Objects (GPOs) to block user installation of unvetted extensions (ExtensionInstallBlocklist = *).
* Restrict WebRequest Permissions: Limit extensions that require access to sensitive authenticated domains, particularly banking, corporate single-sign-on (SSO), and developer platforms.
* Monitor Header & Token Interception: Regularly audit extension permissions for webRequest, declarativeNetRequest, and broad host permissions (
Sources and Reference Intelligence: Socket Threat Research, The Hacker News, Twitch Developer Documentation.