Security firm Socket found that the Chrome and Firefox extension 'Twitch Enhanced Viewer | JeetBot,' which promises ad-blocking and forced 1080p playback, secretly captures users' Twitch OAuth session tokens. The credentials are routed through proxy servers run by JeetBot, a Russian-language streaming and chatbot service, where they land in plaintext request logs accessible to the vendor. The extension exempts ten hardcoded Russian-language channels from this behavior, and its own store listing admits earlier versions sent tokens to its servers outright.
bleepingcomputer.com
· 2026-09-14
BleepingComputer is hosting a live webinar on September 23, 2026, with Material Security's Rajan Kapoor and Fireside Consulting's Rick Fitzgerald, who will dissect two real breaches of Google Workspace environments carried out through malicious OAuth applications and social engineering rather than stolen passwords. The session will walk through how the attacks unfolded, the security gaps that let them succeed, and the response decisions made in the early hours of each incident.
bleepingcomputer.com
· 2026-09-14
Val Town, a vibe coding platform, describes how it adopted Dynamic Client Registration (DCR), a little-known OAuth extension built into the MCP spec by Anthropic and OpenAI, to let apps automatically register as OAuth clients without manual developer portal work. Using this, Val Town built its MCP server so Claude and ChatGPT can authenticate into user accounts, and created a library called std/oauth that lets any app add 'Login with Val Town' in just two lines of code.
blog.val.town
· 2026-09-04
A long-time paying Anthropic customer on the $200/month Claude Max plan reports abrupt account termination via a form email citing 'suspicious signals' tied to a Usage Policy violation, with no specific reason given. The user says another Max subscriber elsewhere was banned right after paying, and the only appeal route is an automated in-product form rather than contact with a person.
kix.codes
· 2026-09-02
GoKawiil