Security company Socket said the extension, “Twitch Enhanced Viewer | JeetBot”, was available through both the Chrome Web Store and Mozilla’s Firefox Add-ons marketplace when its findings were published on September 11. Socket counted about 30,000 Chrome users and 552 Firefox users, taking the combined exposure to roughly 31,000 accounts.
The extension is marketed as a viewing enhancement that blocks advertising, enables higher-quality streams, bypasses regional restrictions and automatically collects channel points. Socket’s analysis found that the software redirects Twitch video-playlist requests through operator-controlled proxy servers and, in current builds, appends the viewer’s OAuth credential to the redirected request as an “auth” query parameter.
That token is not limited to video playback. Socket said its code review showed the same credential was used with Twitch’s token-validation endpoint, identifying it as an account-scoped OAuth token. Such user access tokens can authorise actions permitted by their scopes, while Twitch’s developer documentation warns that access tokens should be protected like passwords.
Because the credential is placed inside the redirected URL, Socket said it can be written into proxy request logs in clear text. Researchers also found that the extension strips the token for a hardcoded list of 10 Russian-language Twitch channels, while forwarding it for other channels watched by users.
The current forwarding mechanism was traced across version 85. x releases. Socket also identified a more direct collection method in earlier 4. x builds, including version 4.8 released in January, where the software sent captured tokens by POST request to a dedicated “set-token” endpoint operated by the same service, with backup endpoints hosted on Deno infrastructure.
Socket linked the receiving infrastructure to JeetBot, which describes itself as a commercial bot service supporting Twitch, Kick and VK Live. The service’s website identifies Popov Aleksandr Alekseevich as its operator, while the extension is listed under the developer name HISHIMIRO. Socket said the infrastructure included JeetBot-controlled proxy and configuration hosts capable of determining where redirected traffic was sent.
The security company said possession of the exposed bearer credentials could allow another party to act through affected Twitch accounts within the permissions attached to each token. Potential capabilities include participating in chat, accessing whispers and interacting with account features such as channel points, depending on the scope granted to the credential.
Twitch’s OAuth documentation says user access tokens are used for APIs that require permission to access user resources. The platform also states that a token may become invalid if it expires, the user changes a password, Twitch revokes it or the user disconnects the associated application from account settings.
Socket advised affected users to remove the JeetBot extension and disconnect active Twitch sessions before signing in again, which it said would invalidate forwarded session credentials. Twitch’s own developer guidance provides a token-revocation process and also allows users to disconnect authorised applications through account settings.
Mozilla’s listing for the extension remained accessible after Socket published its findings and showed version 85.8.7, updated on September 12. The listing disclosed broad permissions covering Twitch domains and several JeetBot-related hosts. Its description also acknowledged that earlier versions transmitted users’ Twitch OAuth tokens to the service’s server for high-quality streaming. The Firefox marketplace later showed roughly 600 users, indicating the add-on remained publicly obtainable after the research disclosure despite the identified token-handling behaviour.
Socket said the Chrome listing’s data-safety declaration had stated that the developer would not collect or use user data, while a linked privacy policy said the extension did not collect, store or process user information. The researchers said the observed token forwarding conflicted with those statements.
The case adds to scrutiny of browser extensions that obtain broad access to authenticated websites while also routing traffic through third-party servers. Twitch requires third-party applications maintaining OAuth sessions to validate tokens regularly, and its documentation says applications must end sessions that rely on credentials once those tokens become invalid.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
