Malicious Twitch Browser Extension Exposes OAuth Tokens From Nearly 31,000 Users

A malicious Twitch browser extension reportedly forwarded users' OAuth session tokens through operator-controlled proxy servers, potentially exposing account access for thousands of users.

A browser extension advertised as a way to enhance the Twitch viewing experience has been found forwarding Twitch OAuth tokens through infrastructure controlled by the service behind the extension.

Security researchers at Socket identified the extension as Twitch Enhanced Viewer | JeetBot. The extension was available for both Google Chrome and Mozilla Firefox and was associated with approximately 30,000 Chrome users and 604 Firefox users, putting the reported total at nearly 31,000 users.

The security issue goes beyond an extension simply having access to Twitch browsing activity. According to the research, the extension extracted a user's Twitch OAuth token and transmitted it to operator-controlled proxy infrastructure when handling video playlist requests.

What Happened?

The affected extension, Twitch Enhanced Viewer | JeetBot, was promoted as a tool for Twitch viewers and streamers. Its advertised functionality included features such as ad-free viewing and access to higher-quality or region-restricted streams.

Socket's investigation found that the extension modified the way Twitch video playlist requests were handled. Instead of allowing the requests to proceed directly, the extension routed them through proxy infrastructure associated with JeetBot.

The critical behavior involved the user's OAuth credential. Researchers reported that current 85.x versions recovered the Twitch OAuth token and included it as an auth parameter when redirecting requests through the operator's proxy.

Socket reported that the token was forwarded for channels outside a hard-coded allowlist of ten channels. This meant that, under the reported implementation, watching other Twitch channels could cause the user's live OAuth token to be transmitted to the proxy infrastructure.

Why OAuth Token Exposure Matters

OAuth tokens are authentication credentials used by applications to access resources on behalf of a user. Twitch's developer documentation explains that access tokens can authorize API requests according to the permissions, or scopes, associated with the token.

That makes an OAuth token fundamentally different from ordinary anonymous viewing data. If a valid bearer token is obtained by an unauthorized party, that party may be able to perform actions allowed by the token without needing the user's password.

Socket reported that the exposed Twitch tokens could provide access to functions associated with the user's authenticated session, including chat and whispers, depending on the permissions available to the token.

The exact impact on an individual account depends on the token's permissions, validity and whether the token was subsequently revoked.

Tokens Were Included in Proxy Requests

One of the most significant technical details is how the credential was transmitted.

According to Socket, the extension placed the OAuth token in a URL query parameter while redirecting Twitch playlist requests through the operator's proxy servers.

Sending a credential in a URL creates additional exposure because URLs can be recorded by intermediary systems, including proxy and server logs. In this case, the token therefore crossed a security boundary and reached infrastructure outside Twitch.

Socket described the behavior as occurring on current 85.x builds of the extension. The researchers also identified token-transmission behavior in earlier 4.x builds.

Earlier Versions Also Transmitted Tokens

The investigation found that the behavior was not necessarily limited to the latest implementation.

Socket reported that earlier 4.x versions, including version 4.8 from January 2026, used a separate mechanism to transmit captured Twitch tokens to infrastructure associated with the service.

This matters for users who installed the extension before the latest release. A later software update cannot automatically undo the exposure of credentials that may already have been transmitted.

Developer Says the Extension Was Updated

The developer subsequently published a notice describing a change to the extension's token-handling behavior.

According to the notice reported by The Hacker News, Firefox version 85.8.7 changes the playlist retrieval mechanism so that the user's Twitch OAuth token is no longer sent to the proxy servers. A corresponding Chrome update was reportedly awaiting store review at the time of publication.

The notice also warned that updating or disabling the extension does not revoke OAuth tokens that may already have been transmitted.

What Affected Users Should Do

1. Check installed extensions. Look for Twitch Enhanced Viewer | JeetBot in Chrome or Firefox.
2. Disable or remove the extension. If an affected version remains installed, removing it stops the extension from making additional requests through its reported mechanism.
3. Update the extension if you continue using it. Only install an updated release through the official browser extension store.
4. Revoke potentially exposed Twitch authorization. Twitch provides mechanisms for invalidating OAuth access and disconnecting integrations.
5. Review your Twitch account. Check for unexpected messages, chat activity, account changes or other actions that you did not perform.
6. Reauthenticate after revocation. If you revoke an affected authorization, sign in again through Twitch's legitimate authentication process when required.
7. Treat OAuth tokens as credentials. Never paste an access token into a website, support chat or untrusted application.

Why Browser Extensions Can Become a Security Risk

Browser extensions operate with privileges that ordinary websites do not have. Depending on their permissions and implementation, extensions can interact with web pages, browser data and network activity.

Those capabilities are necessary for many legitimate extensions, but they also create a significant trust relationship between the user and the extension developer.

An extension that handles authenticated traffic can potentially see or transmit information that would otherwise remain between the browser and the service being accessed.

The Twitch incident demonstrates why users should examine more than an extension's advertised features. Permissions, developer identity, update history, privacy practices and the destinations to which sensitive data is transmitted all matter.

The Risk of Routing Authenticated Traffic Through Third Parties

Proxy services are not inherently malicious. They can be useful for legitimate networking, security and performance purposes.

The security risk increases when an intermediary receives a live authentication credential. At that point, the intermediary becomes part of the authentication trust boundary.

A useful security question for browser extensions is therefore: What sensitive information must this extension transmit to provide the feature it advertises?

If the answer includes an active authentication token, users should understand why the token is required, where it is sent and whether the developer has a legitimate reason to handle it.

What This Incident Does Not Prove

• It does not prove that all nearly 31,000 users had their Twitch accounts taken over.
• It does not establish that every exposed OAuth token was used by an attacker.
• It does not establish that Twitch itself was breached.
• It does not mean that all Twitch browser extensions are malicious.
• It does not mean that updating the extension automatically revokes previously exposed tokens.

Conclusion

The discovery of OAuth token forwarding in Twitch Enhanced Viewer | JeetBot demonstrates how a browser extension can turn a seemingly useful viewing feature into a serious credential-security issue.

The most important distinction is between token exposure and confirmed account compromise. Nearly 31,000 users were reportedly associated with the affected Chrome and Firefox installations, but the available evidence does not establish that every one of those accounts was hijacked.

For potentially affected users, the safest response is to remove or update the extension, revoke potentially exposed Twitch authorization and review the account for unexpected activity.

For security teams, the incident is another reminder that browser extensions deserve endpoint-security scrutiny. An extension can have a legitimate-looking purpose while introducing a new path through which sensitive authentication material can leave the user's device.

References

1. Socket — Malicious Twitch Browser Extension Exposes Users' OAuth Tokens
2. The Hacker News — Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
3. Twitch Developers — Authentication
4. Twitch Developers — Validating Tokens
5. Twitch Developers — OAuth Access Token Scopes