A browser extension marketed as a Twitch enhancement tool has been found forwarding live OAuth session tokens belonging to more than 30,000 users to proxy infrastructure linked to a Russian-language bot service.
Socket’s Threat Research Team identified the extension, named “Twitch Enhanced Viewer | JeetBot,” across both the Chrome Web Store and Firefox Add-ons repository.
The Chrome version, tracked as extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, had roughly 30,000 users, while the Firefox release had another 552 users.
Malicious Twitch Extension Exposes 30,000 Users’ OAuth Tokens
The extension advertises features designed to appeal to Twitch viewers, including advertisement blocking, forced 1080p streaming, regional stream unlocking, and automatic channel-point collection.
However, its traffic-routing mechanism exposes a significantly more sensitive credential than is required to deliver video playback. The extension’s content script captures the Authorization header used by Twitch’s web client, along with the Twitch device ID, and passes those values to its background process.
The background logic strips the header prefix to recover the raw OAuth token, then validates it against Twitch’s token-validation service.
Kush Pandya said this demonstrates that the extension processes account-scoped OAuth credentials rather than only the limited stream playback tokens normally found in Twitch video URLs.
Such OAuth tokens can function as bearer credentials: anyone with one may be able to act as the affected user without needing their password or a separate MFA prompt.
In current 85.x builds, the extension redirects video-playlist requests for Twitch’s usher.ttvnw.net service through a JeetBot-controlled proxy.
During that redirect, it adds the user’s OAuth token to the URL as an auth query parameter, alongside the device ID and proxy configuration data.
Placing an authentication credential in a URL is particularly risky because URLs may be retained in web-server access logs, reverse-proxy logs, monitoring systems, browser histories, and intermediary telemetry.
The exposure occurs whenever an affected user watches most Twitch channels through the extension. The extension excludes a hardcoded allowlist of ten Twitch channels from the token-forwarding flow.
The listed accounts are Russian-language streamer channels, including several associated with the Counter-Strike community.
For channels outside that list, the extension appends the OAuth token to requests routed through the operator-controlled proxy.
The exception suggests the extension’s developers deliberately implemented separate handling for a limited set of channels rather than applying a universal privacy safeguard.
Older 4.x releases reportedly used a more direct collection method. These versions sent captured tokens in JSON POST requests to a set-token endpoint hosted on JeetBot infrastructure, with fallback endpoints on Deno-hosted services.
Russian-language comments in the code referenced remembering the last transmitted token and enforcing a five-second cooldown between submissions.
The primary proxy domain, enhanced[.]jeetbot[.]cc, is linked to JeetBot, a commercial service offering bots for Twitch, Kick, and VK-Live. Related infrastructure includes ext-styles[.]jeetbot[.]cc, proxy[.]morphilina[.]me, and alternate JeetBot proxy hosts.
The extension’s marketplace disclosures reportedly claimed it did not collect, process, or sell user data. Those statements conflict with the observed routing of live Twitch account tokens to third-party infrastructure.
Users should remove the extension immediately, revoke active Twitch sessions, and reauthenticate. Security teams should hunt for both Chrome and Firefox extension identifiers, block the associated domains, and scrutinize browser extensions that combine broad Twitch host permissions with third-party traffic proxies.
IOCs
| IOC type | Indicator | Description |
|---|---|---|
| Chrome extension ID | pnhhdhhcadcjfckjhpmjneldiegbojfb | Chrome Web Store identifier for the malicious Twitch Enhanced Viewer | JeetBot extension |
| Chrome extension SHA-256 | e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 | SHA-256 hash associated with the malicious Chrome extension package |
| Firefox extension ID | twitchenhancedviewer@example.com | Firefox Add-ons identifier for the Twitch Enhanced Viewer extension |
| Firefox extension SHA-256 | 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc | SHA-256 hash associated with the malicious Firefox extension package |
| Token-forwarding proxy | enhanced[.]jeetbot[.]cc | Primary JeetBot proxy that receives Twitch OAuth tokens through the auth URL parameter |
| Proxy configuration API | ext-styles[.]jeetbot[.]cc/api/v1/proxies | Server-side proxy catalog used to distribute operator-controlled proxy destinations |
| Token-strip proxy | proxy[.]morphilina[.]me | Alternate proxy involved in forced token-stripping traffic flows |
| IP address | 152[.]53[.]177[.]186 | Infrastructure hosting jeetbot[.]cc, api[.]jeetbot[.]cc, enhanced[.]jeetbot[.]cc, and enhanced-1[.]jeetbot[.]cc |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
