A malicious Twitch browser extension has been reportedly forwarding the live OAuth session tokens of around 31,000 users to proxy servers run by a Russian commercial bot service, according to Socket.
The cross-store browser extension Twitch Enhanced Viewer | JeetBot was live on both the Chrome Web Store and Firefox Add-ons when Socket published its research on September 11, with about 30,000 Chrome users and 552 on Firefox.
The listings are still live at the time of writing.
A Token the Extension Does Not Need
The extension markets itself as a quality-of-life tool, blocking ads, forcing 1080p and unlocking regions. Delivering that means routing Twitch video-playlist requests through JeetBot proxy servers, and Socket found the user's OAuth token rides along on the redirect.
The OAuth token is appended as a URL query parameter, so it is written in cleartext into the proxy's request logs. Socket said it is the account-scoped Twitch token rather than the narrow playback token, and proved it by showing the extension sends the same value to Twitch's own validation endpoint.
That credential is a bearer token. Whoever holds it can read and send whispers, post in chat and spend channel points on the account, without requiring a password or second factor authentication.
Socket's strongest evidence on intent is that the extension does not need the token to work. It already handles the playback token separately, and for a hardcoded list of 10 Russian-language streamer channels it routes traffic through the same proxy with no account token attached at all.
Earlier Builds Stored the Tokens
Version 4.x builds went further. Socket said version 4.8, from January 2026, posted captured tokens to a dedicated set-token endpoint on JeetBot infrastructure, with backups on two Deno services.
Those builds tracked the last token sent and applied a five-second cooldown, which Socket said only makes sense if the receiving server was keeping them. Russian-language comments in the code instruct the extension to fail silently if a token send does not go through.
The set-token endpoints are gone from later builds, and Socket noted the version number jumped from 7.2.6 in April to 85.2.2 in May, when the inline forwarding appeared.
None of this is disclosed. The Chrome Web Store data-safety section says the developer will not collect or use user data and does not sell it to third parties, while the linked privacy policy says the extension does not collect, store or process any user data.
Socket told users to remove the extension, then disconnect all sessions in Twitch account settings and re-authenticate, which invalidates any forwarded token. It told security teams to treat browser extensions holding host permissions over an authenticated service, combined with a third-party proxy destination, as a credential-exposure risk.
Google, Mozilla and Twitch were approached for comment. This article will be updated with any response.