GoKawiilTwitch add-on JeetBot leaks 30,000 users' OAuth tokens to Russian bot service
Security firm Socket found that the Chrome and Firefox extension 'Twitch Enhanced Viewer | JeetBot,' which promises ad-blocking and forced 1080p playback, secretly captures users' Twitch OAuth session tokens. The credentials are routed through proxy servers run by JeetBot, a Russian-language streaming and chatbot service, where they land in plaintext request logs accessible to the vendor. The extension exempts ten hardcoded Russian-language channels from this behavior, and its own store listing admits earlier versions sent tokens to its servers outright.
GoKawiil's interpretation of the reporting above, not reported fact.
An OAuth token can let an attacker act as the victim on Twitch, potentially hijacking accounts, streams, or chat without needing a password. Because the extension is listed on official Chrome and Firefox stores with tens of thousands of installs, the incident shows how browser marketplaces can still distribute credential-stealing tools disguised as helpful streaming utilities.
- Extension has over 30,000 installs across Chrome and Firefox official stores.
- It exfiltrates Twitch OAuth tokens via proxy servers tied to JeetBot, exposing them in plaintext logs.
- Ten Russian-language channels are excluded from the token theft, suggesting a deliberate, targeted design.
Source: bleepingcomputer.com, 2026-09-14
Published there as: “Twitch extension with 30K installs exposes users’ OAuth tokens”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.