A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service.
The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store -
- Chrome - pnhhdhhcadcjfckjhpmjneldiegbojfb - 30,000 users (Published on June 26, 2025)
- Firefox - twitchenhancedviewer@example.com - 604 users (Published on July 7, 2025)
Both extensions are still available for download as of writing. The extension listing description states: "JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control," adding it "expands Twitch capabilities: 1080p stream for regions with constraints."
"Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket security researcher Kush Pandya said. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."
"The operator is a commercial Twitch, Kick, and VK Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure."
While the extension claims to offer an ad-free experience and serve region-unlocked content, it does so by routing Twitch's video-playlist requests to "usher.ttvnw[.]net" through operator-controlled proxy servers along with the user's OAuth token as an "&auth=" query parameter.
Specifically, the add-on embeds code to recover the Twitch OAuth token and send it to the proxy. The token can enable access to a user's chat, whispers (i.e., private messages), and account settings.
Given that the token is placed in the URL query string, it gets written in cleartext into the proxy server's request logs. The token redirection mechanism, however, is excluded for a hard-coded list of 10 Twitch channels, most of them being Russian-language streamers with thousands of followers -
- pch3lk1n (580K followers)
- fasoollka (361K followers)
- flamie (132K followers)
- dosia (29 followers)
- fander (2 followers)
- almazer (4 followers)
- forzorezor (177K followers)
- akyuliych (1.1M followers)
- lagoda1337 (225K followers)
- lagoda (77.3K followers)
"For every channel outside this list, the user’s live token is forwarded to the proxy," Pandya explained. "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net."
JeetBot advertises itself as a "powerful bot for Twitch, Kick and VK Live with message speech synthesis, automatic translation, and many other features to enhance interaction with viewers." It claims to have over 26,000 active streamers and 1 billion processed messages. The site's footer identifies the operator as a Cyprus-based developer named Aleksandr Popov. On their LinkedIn profile, the developer claims JeetBot to be their pet project.
However, it appears that the developer has already taken steps to address the problem. An alert issued on the JeetBot documentation page now states that version 85.8.7 of the Firefox add-on addresses the problem and that an equivalent Chrome version is currently under review -
In the previous implementation, the extension sent the user's Twitch OAuth token to our proxy servers to retrieve stream playlists. An OAuth token is a credential and must be protected.
Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies.
Check your installed extension version and update to 85.8.7 or later. Older installations using the previous mechanism continue to send the token until updated.
The documentation also urges users to temporarily disable the extension to halt further transmission of the token if the extension is not available. However, the developer warned that disabling or updating the extension does not revoke previously transmitted tokens.
When contacted for comment, Popov told The Hacker News that the exfiltration of the Twitch OAuth tokens was an oversight that has been addressed in the latest version of the extensions. The developer also noted that a Chrome update has been submitted and is still awaiting Chrome Web Store review.
"We appreciate Socket drawing attention to the token-handling and disclosure concerns," Popov said. "We have taken those concerns seriously and changed the extension’s implementation. We acknowledge that the previous description and privacy policy did not adequately explain the transmission of Twitch OAuth tokens to our proxy servers. That was an oversight on our part, and we take responsibility for it."
Asked why the token redirection mechanism was omitted for those ten channels, Popov stated it was part of a playback workaround that was created to address an error that viewers reported when attempting to access Twitch outside Russia or via VPN. The list can be modified by navigating to the extension's "Channels with restrictions" setting starting version 85.8.4 -
Viewers reported being unable to watch these channels when accessing Twitch from outside Russia or through VPN connections. The Twitch player displayed the following message:
"A proxy or unblocker has been detected. This premium content will not be available to you while it is in use. (Error #3)"
We introduced a separate playback workaround to address this specific error. That mechanism did not require forwarding the viewer's OAuth token, so the extension omitted it when routing requests through that alternative playback path.
 |
| User-adjustable playback setting to add/remove Twitch channels |
The ten channels were the default entries for this workaround, based on viewer reports. The list was configurable: users could add or remove channels through the extension's interface. It was therefore a user-adjustable playback setting, rather than a fixed exemption for those ten channels.
Popov also told The Hacker News that the previous token forwarding feature was implemented to obtain Twitch stream playlists and support playback features, and that similar approaches have been implemented by other Twitch playback extensions such as ReYohoho Twitch Proxy, XT Viewer, and ggsel Ханти.
However, what sets these extensions apart is that they explicitly mention in their Chrome Web Store listings that the OAuth token is transmitted to their server to provide "1080p/1440p quality access" for Russian users. "In our own checks, we also observed these extensions transmitting tokens in URL query parameters," Popov pointed out. "Their use elsewhere does not remove our responsibility to protect credentials and accurately disclose data handling."
"Day-to-day development of the extension was handled by Hishimiro. I did not ensure that its description and privacy policy kept pace with the implementation. This was a failure in our review process, and we accept responsibility as a team."
Popov also pushed back against the characterization of the extension as malicious, stating its end goal is to provide playback functionality and emphasized that the forwarded tokens are not used for any kind of unauthorized account activity. "We recognize the security risk of the previous design, which is why we removed the need to forward users' OAuth tokens," he added.
Socket, for its part, told The Hacker News that it's been in touch with the extension developer and that it's reviewing the changes.
"Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure," Socket said.
"A Twitch OAuth session token is a bearer credential: whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points. The exposure is undisclosed in both store listings."
