A malicious browser extension masquerading as a quality-of-life utility for Twitch has systematically compromised the live OAuth session tokens of more than 31,000 users, funneling sensitive credentials directly to proxy infrastructure controlled by a Russian commercial bot service. According to comprehensive technical research published by software supply chain security firm Socket, the rogue add-on—marketed under the name Twitch Enhanced Viewer | JeetBot—remained actively downloadable on major browser marketplaces even after its malicious data-exfiltration mechanics were publicly exposed.
The incident highlights ongoing, systemic vulnerabilities within official browser extension storefronts, where malicious actors routinely bypass automated safety checks to harvest valuable digital assets. For the tens of thousands of users who installed the utility in search of enhanced streaming features, the compromise exposes their accounts to unauthorized chatting, whispering, and resource manipulation without their knowledge or consent.
Anatomy of the Exploit: How the JeetBot Extension Hijacks Sessions
The Twitch Enhanced Viewer | JeetBot extension positioned itself as an all-in-one performance and customization tool for the popular live-streaming platform. Developers behind the utility promised users an array of beneficial features, including native advertisement blocking, forced 1080p video playback resolution, and the ability to bypass regional broadcasting restrictions. To deliver these promised capabilities, the extension routed video-playlist requests through external proxy servers operated by JeetBot.
However, Socket’s investigative analysis revealed that this proxy-routing architecture served as a stealthy mechanism for credential theft. Whenever a user engaged with Twitch through the extension, their sensitive account-scoped OAuth token was appended directly to the request as a URL query parameter. Because the token traveled within the URL string, it was permanently recorded in cleartext within the external proxy’s request logs.
Security analysts confirmed that the harvested credential was not a narrow, low-privilege playback token, but rather a full account-scoped bearer token. Possession of this token grants an attacker nearly complete control over the victim’s Twitch account. With the bearer token in hand, malicious actors can read and transmit private whispers, post messages in chat rooms across any channel, and spend accumulated channel points—all without needing to know the user’s account password or bypass multi-factor authentication (MFA) protections.
Crucially, Socket’s technical assessment established definitive intent on the part of the developers. Forensic code analysis demonstrated that the extension did not require the OAuth token to fulfill its advertised functions. The add-on already handled standard playback tokens independently. Furthermore, for a hardcoded blacklist of ten specific Russian-language streamer channels, the extension routed traffic through the exact same proxy servers without attaching any user account tokens whatsoever, proving that the harvesting of external user credentials was a deliberate, targeted operation.
Evolution of the Threat: From Stored Tokens to Real-Time Exfiltration
The malicious behavior of the JeetBot extension evolved over several months, shifting from localized database storage to active, real-time data forwarding. In earlier iterations—specifically the version 4.x builds released in January 2026—the extension took a more aggressive approach to credential harvesting. Version 4.8 was found to actively capture active user tokens and transmit them directly to a dedicated token-ingestion endpoint on JeetBot’s primary infrastructure, while simultaneously maintaining redundant backups on two separate Deno deployment services.
These earlier builds incorporated sophisticated tracking mechanisms. The code monitored the last transmitted token and enforced a strict five-second cooldown window between transmissions—a programming logic that serves no functional purpose unless the receiving remote server is actively cataloging and storing the incoming credentials. Additional forensic evidence uncovered by Socket included Russian-language comments embedded within the source code. These comments explicitly instructed the extension to fail silently in the background if a token transmission failed, ensuring that users remained completely unaware of the ongoing data theft.
By subsequent updates, the explicit set-token API endpoints were removed from the extension’s codebase, altering how the captured data moved through the network. A peculiar anomaly in version numbering further illustrated the erratic development cycle: the version jumped abruptly from 7.2.6 in April to an inflated 85.2.2 in May. It was during this period that the developers transitioned to the inline query-parameter forwarding method, embedding the sensitive OAuth tokens directly into the standard proxy redirection traffic.
Platform Compliance and Deceptive Privacy Practices
Throughout its operational lifespan, the developers of Twitch Enhanced Viewer | JeetBot maintained a facade of regulatory compliance on official app stores. The data-safety disclosure form on the Chrome Web Store explicitly stated that the developer neither collected nor utilized user data, nor shared or sold such data to third parties. Similarly, the developer’s linked privacy policy assured prospective users that the extension did not collect, store, or process any form of user data whatsoever.
These declarations directly contradicted the actual operations of the software. At the time of Socket’s initial public disclosure on September 11, the extension maintained an active footprint of approximately 30,000 installations on the Chrome Web Store, supplemented by an additional 552 active users on the Mozilla Firefox Add-ons platform. Despite the publication of detailed technical findings outlining active credential theft, the listings remained accessible for download on both platforms, raising critical questions regarding the response times of platform moderators to verified security threats.
Chronology of the JeetBot Extension Incident
January 2026: Version 4.8 of the Twitch Enhanced Viewer | JeetBot extension is deployed, featuring explicit code designed to capture user OAuth tokens and upload them to dedicated JeetBot endpoints and Deno backup servers.
April 2026: The extension’s version numbering reaches 7.2.6, maintaining the underlying proxy-routing architecture and data-collection routines.
May 2026: A significant version jump to 85.2.2 occurs. The developers alter their exfiltration technique, removing dedicated storage endpoints and shifting to inline token forwarding via URL query parameters routed through proxy servers.
September 11, 2026: Security firm Socket publishes comprehensive research detailing the malicious nature of the extension, revealing that approximately 30,000 Chrome users and 552 Firefox users are actively exposed.
Post-Disclosure: Despite public warnings and technical verification of active credential exfiltration, the extension remains live on the Chrome Web Store and Firefox Add-ons marketplace at the time of reporting.
Mitigation Strategies for Affected Users and Security Teams
Security researchers have issued urgent remediation guidelines for individuals who installed the compromised browser add-on. Because the exfiltrated OAuth tokens function as valid bearer credentials, simply uninstalling the browser extension is insufficient to secure an account.
Socket recommends a comprehensive, multi-step recovery process for all impacted users:
- Immediately remove and uninstall the Twitch Enhanced Viewer | JeetBot extension from all web browsers.
- Navigate to the official Twitch account settings security panel.
- Locate the session management section and disconnect all active login sessions globally across all devices.
- Re-authenticate by logging back into the account, a process that immediately invalidates any previously forwarded or intercepted OAuth tokens.
For enterprise security operations and organizational IT teams, the incident serves as a stark reminder of the inherent risks posed by browser extensions. Security analysts advise treating any browser extension that maintains broad host permissions over authenticated services—particularly when combined with third-party proxy destinations—as an acute credential-exposure risk. Organizations should enforce strict endpoint management policies that audit and restrict the installation of unverified third-party browser add-ons on corporate networks.
Industry and Platform Response
As the implications of the JeetBot campaign continue to unfold, leading technology companies face mounting pressure to tighten oversight of third-party extension marketplaces. Representatives from Google, Mozilla, and Twitch were formally approached by security researchers and journalistic outlets for comment regarding their respective platform moderation protocols and remediation plans for the affected user base. Industry observers anticipate that public scrutiny will drive tighter automated code reviews and more rigorous compliance auditing for extensions requesting broad proxy routing and network interception capabilities. This article will be continuously updated as official statements and platform enforcement actions become available.
