Full Report
A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome -
Analysis Summary
# Incident Report: JeetBot Browser Extension OAuth Token Leak
## Executive Summary
A malicious cross-store browser extension named "Twitch Enhanced Viewer | JeetBot" was identified exfiltrating Twitch OAuth tokens from nearly 31,000 users. The extension captured tokens via network-layer redirects and forwarded them in cleartext to proxy servers operated by a Russian commercial bot service. While the developer claims the leak was a design flaw intended to bypass regional restrictions, the captured tokens grant broad access to user accounts, including private messages and settings.
## Incident Details
- **Discovery Date:** September 14, 2026 (Public reporting by Socket)
- **Incident Date:** Ongoing since June 26, 2025 (Chrome store debut)
- **Affected Organization:** Twitch Users
- **Sector:** Social Media / Streaming
- **Geography:** Global (with specific exclusions for Russian streamers)
## Timeline of Events
### Initial Access
- **Date/Time:** June 26, 2025 (Chrome); July 7, 2025 (Firefox)
- **Vector:** Official Browser Extension Stores (Google Chrome Web Store / Mozilla Firefox Add-Ons)
- **Details:** The extension was marketed as a tool to unlock 1080p streams in restricted regions and provide an ad-free experience.
### Lateral Movement
- **N/A:** The attack focused on external credential harvesting rather than internal network movement.
### Data Exfiltration/Impact
- **January 2026:** v4.8 builds were observed POSTing tokens to dedicated endpoints on `deno[.]dev` and `deno[.]net`.
- **June 2025 - September 2026:** v85.x builds forwarded OAuth tokens as cleartext `&auth=` query parameters to operator-controlled proxy servers.
- **Scope:** 30,000 Chrome users and 604 Firefox users affected.
### Detection & Response
- **Detection:** Discovered by Socket security researcher Kush Pandya.
- **Response Actions:** Researcher published findings; Developer released v85.8.7 to Firefox to remove the token-forwarding mechanism (Chrome version placed under review).
## Attack Methodology
- **Initial Access:** Supply Chain / Malicious Browser Extension.
- **Persistence:** Browser extension remains installed and active until manually removed or disabled by stores.
- **Privilege Escalation:** Not applicable; relies on user-granted extension permissions.
- **Defense Evasion:** Used a hardcoded "allowlist" of 10 Russian streamers to bypass token forwarding for their channels, likely to avoid detection by specific high-profile targets or local monitors.
- **Credential Access:** OAuth Token theft via embedding code to recover tokens from the session.
- **Discovery:** Relayed live authenticated sessions through operator infrastructure.
- **Collection:** Captured OAuth tokens inline during video-playlist requests to `usher.ttvnw[.]net`.
- **Exfiltration:** Tokens sent as query parameters in URLs, causing them to be logged in cleartext on proxy servers.
- **Impact:** Potential unauthorized access to chat, whispers (DMs), and account settings.
## Impact Assessment
- **Financial:** Unknown; potential for account sale or fraudulent bot activity.
- **Data Breach:** ~30,600 Twitch OAuth tokens leaked.
- **Operational:** Users' private communications (whispers) and account controls compromised.
- **Reputational:** Damage to user trust in third-party Twitch enhancement tools.
## Indicators of Compromise
- **Network Indicators:**
- `usher.ttvnw[.]net` (Legitimate Twitch domain used for traffic interception)
- `jeetbot[.]cc`
- `deno[.]dev` (Abused for token POSTing)
- `deno[.]net` (Abused for token POSTing)
- **File Indicators (Extension IDs):**
- Chrome: `pnhhdhhcadcjfckjhpmjneldiegbojfb`
- Firefox: `[email protected]`
- **Behavioral Indicators:**
- Extension requesting broad permissions to intercept web requests.
- Outbound traffic to proxy servers containing `&auth=` parameters.
## Response Actions
- **Containment:** Developer released version 85.8.7 for Firefox; Chrome version submitted for review.
- **Eradication:** Users urged to update to the latest version or delete the extension.
- **Recovery:** Users must manually revoke their Twitch OAuth tokens via Twitch account settings, as updating the extension does not invalidate already-leaked tokens.
## Lessons Learned
- **Key Takeaways:** Official browser stores are still susceptible to hosting extensions that exfiltrate sensitive credentials under the guise of "utility" features (like region-unlocking).
- **Shortcomings:** Cleartext transmission of OAuth tokens in URLs is a critical security flaw that should have been flagged during automated or manual store reviews.
## Recommendations
- **For Users:** Immediately revoke all active Twitch sessions/authorized apps and change passwords.
- **For Developers:** Never transmit credentials (tokens, passwords) in URL query strings.
- **For Organizations:** Implement browser extension management policies (allowlisting) to prevent users from installing unverified third-party add-ons on corporate devices.