Enhanced Viewer for Twitch: OAuth Token Forwarded to JeetBot Proxy

1. Basic Information

• Original Title: Malicious Twitch Browser Extension Exposes OAuth Tokens
• Source: Socket, BleepingComputer
• Published Date: 2026-09-11
• Updated Date: None
• Severity: High
• Basis for Severity: Code analysis confirmed logic that sends authentication tokens to a third party, and the Chrome version alone has approximately 30,000 users. This is separate from actual data leak and abuse figures.
• Original Link: Malicious Twitch Browser Extension Exposes OAuth Tokens
• Related Sources: BleepingComputer: Twitch extension with 30K installs exposes users' OAuth tokens
• Related Threat Actor: JeetBot Operators
• Related Products: Enhanced Viewer for Twitch, Google Chrome, Mozilla Firefox, Twitch

2. Summary

A Twitch browser extension for Chrome and Firefox included logic to forward OAuth tokens obtained from the Authorization header to a third-party proxy. According to Socket, the Chrome version has about 30,000 users.

3. Attack Flow

1. Forwarding OAuth Tokens from the Extension

1. A user installs Enhanced Viewer for Twitch.
2. The extension retrieves the Authorization header from the Twitch web client.
3. It appends the token to the auth query parameter of requests sent to the video relay proxy.
4. The operator-managed proxy receives the token.
5. Inference: If valid tokens remain, they could be used for session hijacking.

4. Attacker Location and Execution Point

• Browser extension publisher and update authority.
• Operator of the JeetBot-related proxy that relays Twitch video requests.

5. Visibility for Victims and Administrators

Victims

• Twitch streaming continues to function normally, making the token forwarding difficult to notice.

Administrators

• Inference: In environments where browser extension lists include the target ID and HTTP traffic logs are available, URLs directed to third-party proxies may contain the auth parameter.

6. Success and Failure Conditions

Success Conditions

• The user installs the target extension and logs in to Twitch.
• The extension successfully accesses the Authorization header and communicates with the operator proxy.

Failure Conditions and Risk Mitigation

• Remove and block the target extension.
• Revoke all existing Twitch sessions and re-authenticate.

7. Impact Upon Success

• Twitch OAuth tokens are sent to a third-party proxy.
• Inference: Accounts or sessions may be compromised depending on token permissions and expiration times.

8. Observable Logs

Inference: Depending on configuration, the following logs can be used for internal investigations:

Email

• The distribution vector for this issue is a browser extension; email delivery has not been reported.

Proxy, SWG, and DNS

• Inference: Cross-reference with Socket's IOCs to check for connections to domains such as enhanced[.]jeetbot[.]cc. If full URLs are captured, inspect for the auth parameter or /set-token. DNS queries alone cannot verify token exfiltration.

Endpoint and EDR

• Inference: Verify extension IDs, versions, installed endpoints, and browser profiles from browser management data. Because operations occur within the browser, EDR child process monitoring alone will not capture this activity.

Authentication and IdP

• Inference: Review active sessions and suspicious activity visible on Twitch accounts. Organization IdP logs may not always track individual personal Twitch sessions.

SaaS and Cloud

• Inference: For managed browsers, check management console logs for extension installation, removal, and permission policies. Keep this separate from available log scopes on the Twitch side.

Network

• Inference: Check for communications from the browser to third-party proxies. HTTPS destination domains alone cannot distinguish between video relay traffic and requests carrying tokens.

9. Determining Attack Success

Scope Confirmed via Public Information

• Information Theft or Session Compromise Confirmed: Public Information: Socket confirmed through code analysis that tokens retrieved from the Authorization header are forwarded to a third-party proxy. This does not indicate actual exfiltration events or abuse counts in individual user environments.

Internal Determination Criteria

• Subsequent Compromise Confirmed: Criteria: Unauthorized logins, settings changes, or posts made using the forwarded token are identified. The number of occurrences remains unconfirmed in public reports.

10. Investigation Playbook

Inference: The following is an internal investigation procedure based on public information.

Investigation Starting Point

• Start by identifying installations of the target extension ID or network traffic directed to the proxies identified by Socket.

Initial Verification

• Check the extension ID, version, installation period, and used browser profile, then cross-reference them with Twitch login timestamps and usage duration.

Endpoint and Server

• Preserve extension lists, settings, and necessary artifacts. Investigate v85.x query forwarding and legacy v4.x POST submissions based on the version.

Authentication and Cloud

• Identify the Twitch account used within that profile and check for unauthorized setting changes or posts.

Subsequent Actions

• Investigate token forwarding and post-forwarding account abuse separately. Do not assume full account compromise based solely on the presence of the extension.

Containment

• Remove and block the target extension, follow Socket's recommendations to invalidate existing Twitch sessions, and re-authenticate. Handle tokens found in investigation logs as sensitive information.

Decision Categories

• Distinguish between extension installation, presence of forwarding logic, actual token transmission, and unauthorized use of forwarded tokens.

11. Defense and Detection Ideas

Inference: The following are proposed detection and mitigation measures based on public information.

Single Event

• Use the detection of the target extension ID as a starting point for investigation, and check HTTP records for auth or /set-token parameters pointing to third-party proxies.

Time-Series Correlation

• Correlate extension installations on the same endpoint and profile with Twitch usage and third-party proxy connections. Without traffic content, successful transmission remains unconfirmed.

Threat Hunting

• In addition to current extension inventories, check historical installation records to identify previously used endpoints and legacy version transmission paths.

Log Gaps and Limitations

• Limited HTTPS visibility, extension version history, and platform-side logs make it difficult to determine the scope of transmissions and unauthorized use. Avoid unnecessary collection and sharing of token values.

Priority Countermeasures

• Prioritize removing and blocking the target ID, invalidating and re-authenticating Twitch sessions, and managing browser extension allowlists.

12. Facts, Inference, and Hypothesis

Facts

• According to Socket, the Chrome extension ID is pnhhdhhcadcjfckjhpmjneldiegbojfb with approximately 30,000 users, and the Firefox add-on ID is [e-mail] with 552 users.
• Version 85.x analyzed by Socket retrieves the Twitch Authorization header and forwards it as an auth query parameter to an operator-managed proxy.
• Code analysis revealed logic to exclude this token forwarding for 10 hardcoded Russian streamer channels.
• Legacy versions (v4.x) were found to include logic that posts tokens to /set-token along with alternative transmission destinations.
• Socket notes that designing URLs to include tokens in query parameters can leave tokens exposed in access logs at destinations and intermediaries.
• Socket recommends removing the extension, invalidating Twitch sessions, and re-authenticating.

Inference

• Valid tokens held by third parties could be used for unauthorized access to Twitch sessions depending on permission scopes.

Hypothesis

No additional hypotheses. Unconfirmed items are documented in Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1176.001 Software Extensions: Browser Extensions (Confidence: High): A browser extension with malicious token forwarding logic is installed and executes within the browser.
• T1528 Steal Application Access Token (Confidence: High): Retrieves and forwards Twitch OAuth tokens.
• T1041 Exfiltration Over C2 Channel (Confidence: Medium): Includes tokens within video requests sent to operator proxies.

14. Unknowns and Further Investigation

• Retention period for forwarded tokens and actual number of abuse cases.
• Final removal status on the Chrome and Firefox extension stores.

15. Impact on SOCs and Organizations

In organizations with Twitch users, review managed browser extension inventories and allowlists, remove the target ID, and invalidate sessions.

16. Summary by Role

• SOC: Cross-reference extension IDs and traffic to JeetBot-related proxies; inspect HTTP logs for auth parameters or legacy transmission paths when available.
• Administrators: Remove and block the target extension and invalidate existing Twitch sessions.
• Users: Remove the target extension, invalidate existing Twitch sessions, and log back in.