Malicious Twitch Extension Leaks OAuth Tokens of 30,000 Users to Russian Bot Service

• •The 'Twitch Enhanced Viewer | JeetBot' extension leaks OAuth tokens from over 30,000 users.
• •Tokens are forwarded to a Russian bot service, allowing unauthorized access to Twitch accounts.
• •Users are advised to remove the extension and invalidate their OAuth tokens immediately.

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has been identified as leaking OAuth tokens from nearly 31,000 Twitch users to proxy servers operated by a Russian bot service. The extension is available on both the Chrome Web Store and Firefox Add-ons, with 30,000 users on Chrome and 552 on Firefox. It claims to enhance user experience by blocking ads and enabling 1080p streaming, but it forwards users' live OAuth session tokens through a network-layer redirect to the operator's proxy. The tokens can grant unauthorized access to users' Twitch accounts, including chat and account settings. The extension is still available for download, and users are advised to remove it and invalidate their Twitch sessions. The operator of the service is linked to a Cyprus-based developer named Aleksandr Popov. Earlier versions of the extension were found to POST tokens to a dedicated endpoint, indicating a more aggressive data collection method.