Twitch extension in both browser stores forwards 30,604 users' live OAuth tokens to operator proxies
Socket found that Twitch Enhanced Viewer | JeetBot attaches viewers' live OAuth tokens to playlist requests routed through its operator's proxies, exempting ten Russian-language channels. The Firefox fix has shipped and the Chrome build is in review.
The Watch · Security desk
What happened
- Twitch Enhanced Viewer | JeetBot has 30,000 installs on the Chrome Web Store since June 26, 2025 and 604 on Firefox since July 7, 2025, and both listings were still downloadable when Socket published.
- Socket says the extension relays viewers' live authenticated Twitch sessions through proxy servers run by its operator, a commercial bot service selling to Twitch, Kick and VK Live streamers.
- Because the credential rides in the URL query string, it is written in cleartext into the operator proxy's request logs.
- A hardcoded allowlist exempts ten Russian streamer channels, and watching any other channel forwards the viewer's live token to the proxy.
- The developer's notice warns that disabling or updating the extension does not revoke tokens it has already transmitted.
Why it matters
- Who's exposed exposure Removing the extension stops future forwarding and leaves the logged credential usable. For these accounts, exposure ends when the Twitch session behind the token is invalidated.
- What it limits constraint Firefox users can close this themselves now. The 30,000-install Chrome side waits on Google's review queue before a fixed build exists to install.
- What's now possible capability The hardcoded exemption shows the forwarding can be filtered per channel, and the operator picked the ten channels on the list.
- Who has to decide decision The token left under Twitch host permissions granted at install. Organisations whose staff run brand channels can block that install by allowlisting extensions in the managed browser.
Next story · Build · yesterday
GhostAction's secret-stealing workflows reached 30,000 repos through hijacked developer accounts, researchers sayConfirmed2 publishers
The extension advertises an ad-free stream and region-unlocked playback. It delivers that by routing Twitch's video-playlist requests to usher.ttvnw.net through operator-controlled proxy servers, with the viewer's OAuth token attached [1]. "Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket security researcher Kush Pandya said [2]. The token opens the account's chat, whispers and settings [12].
The delivery method has changed at least once while both listings stayed up. "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net," Pandya said [8]. The Chrome listing went up on June 26, 2025 and the Firefox add-on on July 7, 2025 [25][26]. That leaves the Chrome build on the store for about 14 months before Socket published [24].
The exemption list mixes tiny channels with very large ones: three of the ten have fewer than 30 followers, dosia with 29, almazer with 4 and fander with 2, while akyuliych has 1.1 million and pch3lk1n 580,000 [6][22].
JeetBot sells itself as a bot for Twitch, Kick and VK Live and claims more than 26,000 active streamers and 1 billion processed messages [14]. The site footer credits a Cyprus-based developer, Aleksandr Popov, whose LinkedIn profile calls JeetBot a pet project [15]. The Hacker News described the proxy servers as operated by a Russian commercial bot service [16]. It said it had asked Socket and the developer for comment and had not heard back [17].
The developer has posted an alert on JeetBot's documentation page. "Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies," it says, and "Older installations using the previous mechanism continue to send the token until updated" [18][19]. The Firefox add-on has 85.8.7; the alert says an equivalent Chrome version is under review [20]. Users who cannot get the update are told to disable the extension to stop further transmission [9].
What to watch
- Whether Google approves the Chrome build that stops the token forwarding, or pulls listing pnhhdhhcadcjfckjhpmjneldiegbojfb instead.
- Whether Twitch invalidates sessions for accounts whose tokens reached the operator's proxies, and says so publicly.
- Any statement from Socket or the developer on how long the proxy request logs retained the tokens, and who could read them.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption30
- Hype gap+15
- Incentives40
- Confidence72
Perspective Coverage
4 publishers- Builder
- Builder 26%
- Operator
- Operator 66%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The extension claims to offer an ad-free experience and region-unlocked content, and does so by routing Twitch's video-playlist requests to usher.ttvnw.net through operator-controlled proxy servers along with the user's OAuth token as an "&auth=" query parameter.
- [2]
Socket security researcher Kush Pandya said: "Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy."
- [3]
Pandya said: "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."
- [4]
Because the token is placed in the URL query string, it is written in cleartext into the proxy server's request logs.
- [5]
The extension is named "Twitch Enhanced Viewer | JeetBot" and lists HISHIMIRO/jeetbot.cc as its developer.
- [6]
Follower counts for the ten exempted channels: pch3lk1n 580K, fasoollka 361K, flamie 132K, dosia 29, fander 2, almazer 4, forzorezor 177K, akyuliych 1.1M, lagoda1337 225K, lagoda 77.3K.
- [7]
Both the Chrome and Firefox extensions were still available for download as of the Socket writeup.
- [8]
Pandya said: "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net."
- [9]
The documentation urges users to temporarily disable the extension to halt further transmission of the token if the updated extension is not available.
- [10]
The developer warned that disabling or updating the extension does not revoke previously transmitted tokens.
- [11]
Socket said: "Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure."
- [12]
The token can enable access to a user's chat, whispers (private messages), and account settings.
- [13]
Socket said: "The operator is a commercial Twitch, Kick, and VK-Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure."
- [14]
JeetBot advertises itself as a bot for Twitch, Kick and VK Live and claims to have over 26,000 active streamers and 1 billion processed messages.
- [15]
The JeetBot site's footer identifies the operator to a Cyprus-based developer named Aleksandr Popov, whose LinkedIn profile claims JeetBot is their pet project.
- [16]
The Hacker News described the leaked OAuth tokens as going to proxy servers operated by a Russian commercial bot service.
- [17]
The Hacker News said it had contacted both Socket and the developer for further comment and would update its story on a response.
- [18]
The JeetBot documentation alert states: "Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies."
- [19]
The JeetBot documentation alert states: "Older installations using the previous mechanism continue to send the token until updated."
- [20]
The alert says version 85.8.7 of the Firefox add-on addresses the problem and that an equivalent Chrome version is currently under review.
- [21]
The Hacker News account of Socket's findings was published in September 2026.
- [22]
Three of the ten exempted channels have fewer than 30 followers.
- [23]
The two store listings total 30,604 installs.
- [24]
The Chrome listing was live for roughly 14 months before Socket's findings were published.
- [25]
On the Google Chrome Web Store the extension has the identifier pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users, and was published on June 26, 2025.
- [26]
On the Mozilla Firefox Add-Ons store the extension has the identifier twitchenhancedviewer@example.com, 604 users, and was published on July 7, 2025.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comTwitch extension with 30K installs exposes users’ OAuth tokens
1 article · September 14, 2026
- infosecurity-magazine.comMalicious Twitch Extension Exposes 31,000 Users' OAuth Tokens
1 article · September 14, 2026
- scworld.comMalicious Twitch browser extension leaks OAuth tokens for nearly 31,000 users
1 article · September 15, 2026
- thehackernews.comMalicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
2 articles · September 14, 2026
Topics and entities
Topics
- Browser Extension Security
- OAuth token exposure
Entities
- Chrome Web Store
- Twitch
- Twitch Enhanced Viewer | JeetBot
- Socket