How the JeetBot Twitch Extension Stole OAuth Tokens From 31,000 Users

The extension named "Twitch Enhanced Viewer | JeetBot" presented itself as a tool to improve the Twitch streaming experience. Users who installed it from the Chrome Web Store or Mozilla Firefox Add-Ons believed they were getting additional viewing features. Instead, the extension silently intercepted OAuth authentication tokens generated when users logged into Twitch, then transmitted these tokens to proxy servers controlled by a Russian commercial bot service. OAuth tokens are particularly dangerous to leak because they grant full account access without requiring the original password.

The extension remained available on both major extension marketplaces for a period of time before removal, which allowed it to accumulate installations across multiple platforms. Attackers distributed the malicious code through official channels rather than through direct downloads or compromised websites, which gave the extension a veneer of legitimacy that users naturally trust. The developer listed in the metadata, HISHIMIRO, has connections to the Russian botnet ecosystem, suggesting this was part of an organized credential theft operation rather than an isolated incident. By the time security researchers identified and reported the threat, the damage was already substantial.

When you log into Twitch normally, you provide your username and password once, and Twitch issues you an OAuth token that proves you are authenticated. This token is what actually stays in your browser and allows you to interact with Twitch. If an attacker obtains your OAuth token, they can use it immediately to access your account, change your password, stream from your channel, access your account balance, or modify your privacy settings. Unlike a password breach where you can change your credentials, a stolen OAuth token may give attackers immediate control before you realize anything is wrong. Some Twitch accounts linked to gaming careers or sponsorships become targets for account takeover fraud where attackers hold the channel ransom.

Once their OAuth tokens reached Russian bot service infrastructure, the tokens could be used by anyone with access to those servers. In some cases, stolen Twitch accounts are sold on underground markets or used to amplify streaming scams. In other cases, attackers simply harvest them for identity data or to use the account's reputation for spreading malware links. A single compromised streamer account can be used to trick their followers into visiting phishing pages or downloading trojanized software. The bot service operators may have also cross-referenced the stolen tokens with other data to identify high-value accounts tied to content creators, esports players or accounts with linked payment methods.

Official extension marketplaces like Chrome Web Store and Firefox Add-Ons rely on automated scanning and manual review, but determined attackers can still bypass these checks by obfuscating malicious code or using legitimate-sounding names. Security researchers have documented dozens of cases where credential-stealing extensions or adware reached major stores before removal. The Tor Project and mainstream cybersecurity vendors regularly note that users often trust official distribution channels more than they should, and that checking extension permissions and developer history is the primary defense available to users. What matters to you: a malicious extension needs only a few thousand installs to be profitable, so the incentive to circumvent store policies remains constant.

Begin by checking your browser extensions right now.

1. Open your browser settings and navigate to the extensions or add-ons page
2. Search for any extensions with "Twitch" in the name that you do not recognize or do not remember installing
3. Pay special attention to extensions with generic developer names or those you installed more than a few months ago
4. If you find "Twitch Enhanced Viewer" or "JeetBot" listed, remove it immediately
5. Change your Twitch password from a clean device using the Twitch website directly
6. Check your Twitch account settings for any unauthorized connected applications or changed email addresses
7. Review your streaming history and any broadcasts you did not personally initiate

The most effective defense is minimalism: only install extensions you actively need, and uninstall anything you have not used in three months. Before installing an extension, check the developer name, read the recent reviews carefully, and verify that the extension requests only the permissions it actually needs. For example, a Twitch viewing enhancement tool should not request permission to access all websites or to see your browsing history. Visit the official Twitch website to verify that Twitch has not already released a feature you are considering adding via third-party extension. If you use Twitch for work or streaming, consider using a separate browser profile or a virtual machine for income-related activities, so that a compromised entertainment browser does not expose your professional account.

This incident illustrates that extension marketplaces are attack surfaces, not safety guarantees. Malware that looks like productivity software can arrive through channels you trust. You are the last line of defense: reviewing permissions, checking developer history and removing unused extensions takes five minutes and eliminates most risk. Start today by opening your browser extensions page and removing anything you do not recognize or have not used in the past month. If you actively use Twitch, change your password now from a trusted device.

How do I know if my Twitch account was compromised by JeetBot. Check your Twitch security log in Settings, look for login attempts from unfamiliar locations or IP addresses, and verify that no connected applications or third-party authorizations appear that you did not approve. If you see suspicious activity, change your password and enable two-factor authentication immediately.

Is it safe to use any browser extensions for streaming. Browser extensions can be safe if they come from established developers, request minimal permissions, have recent positive reviews and do not require access to sensitive data. The safest approach is to use only extensions published by the official Twitch team or by developers with long, visible track records and clear privacy policies.

What should I do if I already installed this extension. Remove it immediately, change your Twitch password from a clean device, and review your account for any unauthorized activity. Consider enabling two-factor authentication if you have not already. If you monetize your Twitch account, notify any sponsors or payment partners that your account may have been compromised.

Does this affect only Twitch users. No, the techniques used by this extension (OAuth token theft through browser addons) can target any online service. Users of YouTube, Discord, Reddit and other platforms should follow the same precautions regarding extension installation and permissions.

Source: The Hacker News