Twitch 'Enhancer' Extension for Chrome Caught Sending Live OAuth Tokens to Russian Bot Service

User exposure: The extension reached 30,000+ Chrome users and 550+ Firefox users across both browser stores.

Token forwarding: Live Twitch OAuth session tokens are routed to an operator-controlled proxy.

Operator identity: JeetBot, a Russian commercial bot service, is attributed to Popov Aleksandr Alekseevich.

A malicious cross-store browser extension, "Twitch Enhanced Viewer | JeetBot," quietly forwards users' live Twitch OAuth session tokens to proxy servers run by a Russian commercial bot service.

Socket's Threat Research Team has identified that the extension is currently live on both the Chrome Web Store (ID pnhhdhhcadcjfckjhpmjneldiegbojfb , 30,000 users) and Firefox Add-ons ( [email protected] , 552 users).

What the Extension Promises Viewers

On the surface, it markets itself as a Twitch quality-of-life upgrade – blocking ads, forcing 1080p playback, region-unlocking streams, and auto-collecting channel points.

To deliver that ad-free, region-unlocked video, it redirects Twitch's video-playlist requests through operator-controlled proxies. According to the report , the user's OAuth token travels along with that redirect.

How the Token Gets Captured and Sent

A content script reads the Authorization header straight from the platform's own web client and passes it to the extension's background worker.

When playlist requests get rerouted through the default proxy, enhanced[.]jeetbot[.]cc , the token is appended as an &auth= parameter. “ Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs ,” Socket said.

The attackers obtain a full account-scoped token, not a limited playback credential, which grants access to chat, whispers, and account settings.

A Curious Allowlist, and Rougher Earlier Versions

The token is stripped only for ten hardcoded Russian streamer channels, including pch3lk1n , flamie , and dosia – every other channel gets the token forwarded.

Earlier v4.x builds were more direct, POSTing tokens outright to a set-token endpoint, with backup infrastructure hosted on deno.dev and deno.net .

Infrastructure Behind the Scam

The proxy network resolves across:

152[.]53[.]177[.]186 (netcup GmbH)

80[.]74[.]26[.]162 (CLODO Cloud).

Despite this activity, the Google Chrome Web Store's data-safety section claims the developer "will not collect or use your data" and that the data is "not being sold to third parties."

What Affected Users Should Do

Users affected by this Twitch incident should:

Remove the extension immediately,

Disconnect all Twitch sessions,

Re-authenticate to invalidate any token that may have already been forwarded.

In 2024, Twitch was fined $58,000 by Turkiye's Data Protection Board for a major data breach. Late last month, Malwarebytes warned that 41 fake download sites use real links in a click-hijacking campaign with Counter-Strike, GTA 6, Half-Life, Fallout, and The Witcher lures, and a GTIG report said suspected Russian hackers were weaponizing OAuth logins and more to deliver Vidar and other malware.