Twitch browser extension with 30,000 installs forwarded OAuth tokens to a third-party proxy

What the extension did

A browser extension named Enhanced Viewer for Twitch shipped with hidden credential-harvesting behaviour, according to a code analysis by security firm Socket that BleepingComputer also covered in September 2026. The extension, offered for both Chrome and Firefox, reads the Authorization header that the Twitch web client sends on authenticated requests and passes that value along to a proxy associated with the JeetBot service.

The scale is meaningful but bounded. Socket identified the Chrome build by the extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb and counted roughly 30,000 users, while the Firefox add-on (ID [email protected]) had about 552 users. Those are install counts, not confirmed victims. The public reporting establishes that the malicious logic existed, not how many tokens were actually collected or misused.

How the token forwarding worked

In the version 85.x code Socket examined, the flow is simple: the extension pulls the OAuth token from the Authorization header in the Twitch web client, appends it as an auth query parameter on requests sent to an operator-run video relay proxy, and the proxy receives the credential. Domains tied to the operation include enhanced[.]jeetbot[.]cc.

Older releases behaved slightly differently. Socket found that legacy version 4.x posted tokens to a /set-token endpoint and contained alternative destinations for the data.

One detail stands out from the analysis: the code excluded ten hardcoded Russian streamer channels from the token forwarding, which points to deliberate targeting rather than an accidental data flow.

Socket also flagged a secondary problem with the technique itself. Placing tokens in URL query parameters means the credentials can persist in access logs kept by the destination server and by any intermediary that handles the request, multiplying the exposure well beyond the operator's own proxy.

Why victims had no signal

The extension did not break the functionality it promised. According to the published analysis, Twitch streaming kept working normally, so users had no visible indication that anything was wrong. Because everything happens inside the browser as part of routine-looking requests, endpoint monitoring built around process activity would not surface this activity either.

What affected users and admins should do

Socket's guidance, restated in the follow-up write-ups:

• Remove and block the extension by its ID.
• Revoke all existing Twitch sessions and authenticate again, which invalidates any token already handed over.
• Treat any token values found in investigation logs as sensitive, and avoid collecting or sharing them unnecessarily.
• Investigate by cross-referencing the extension ID and connections to the identified proxy domains. DNS queries alone cannot prove exfiltration, and HTTPS destination metadata cannot distinguish ordinary video relay traffic from requests carrying tokens.

Administrators with managed browser fleets should check extension installation and permission history, including any legacy versions that used the older /set-token transmission path.

A key caution from the analysis: distinguish between installation of the extension, the presence of forwarding logic, actual token transmission, and any subsequent unauthorised use of an account. Finding the extension installed is not, by itself, proof that an account was compromised.

Why it matters

Two things make this incident notable. First, OAuth tokens are bearer credentials: anyone holding a valid one can act as the user until it expires, so quiet exfiltration creates a direct session-hijacking risk whose full impact depends on token permissions and lifetime. Second, the case illustrates how little visibility users and security teams have into browser extensions. A helper add-on with tens of thousands of installs kept its host site working perfectly while appending authentication data to proxied requests, invisible to the user and to conventional endpoint tooling. For developers and platform teams, it is a reminder that extensions run with privileged access to page context and headers, and that extension allowlists, prompt session revocation, and periodic extension inventory audits remain the practical defences when a popular add-on turns hostile.