Twitch Extension Leaked OAuth Tokens of Nearly 31,000 Users

Researchers at Socket have discovered a malicious browser extension that leaked the Twitch OAuth tokens of nearly 31,000 users. The add-on, called “Twitch Enhanced Viewer | JeetBot,” was distributed in two stores at once: on the Chrome Web Store it racked up around 30,000 installs (published June 26, 2025), and on Firefox Add-Ons another 604 (published July 7, 2025). At the time of publication, both versions were still available for download.

The extension promised ad viewing, 1080p streaming, and the unblocking of region-restricted content. It achieved this by routing requests to Twitch's video playlists (usher.ttvnw.net) through the operator's proxy servers — and alongside them, the user's OAuth token went out in the clear, inserted right into the URL as an &auth= parameter. Since the token ended up in the query string, it landed unencrypted in the proxy server's logs.

A token is a key to the account

According to researcher Kush Pandya, a Twitch session token is a bearer credential: armed with it, an attacker can act on the victim's behalf without a password or second factor. That opens up access to chat, private messages (whispers), and account settings, and allows channel points to be spent.

An intriguing detail: forwarding of the token was disabled for a hardcoded list of ten channels — almost all of which belong to Russian-speaking streamers, including some with audiences in the millions. The sessions of viewers on these channels remained untouched, while for everyone else the token went to the operator. Earlier builds (for example, version 4.8 from January 2026) behaved even more aggressively, sending the token to a separate endpoint with fallback addresses on deno.dev and deno.net.

Behind the operation is a commercial bot service for Twitch, Kick, and VK Live, offering speech synthesis, auto-translation, and other features. The service claims more than 26,000 active streamers and a billion processed messages, and the site's footer names Cyprus-based developer Alexander Popov, who describes the project as a “hobby” in his LinkedIn profile.

There's a fix, but the tokens can't be revoked anymore

The developer has already responded: the documentation states that version 85.8.7 for Firefox no longer sends the token to the proxy, and a corresponding build for Chrome is under review. Users are advised to update or temporarily disable the extension. However, the authors honestly warn that disabling or updating does not revoke tokens that were already handed over — those will have to be invalidated manually. Neither store's description made any mention of the fact that data was being transmitted.

Source: The Hacker News