Malicious JeetBot Extension Leaks Twitch OAuth Tokens of 31,000 Users

Approximately 31,000 Twitch users have had their OAuth session tokens leaked through a malicious browser extension used on Chrome and Firefox. The extension, known as “Twitch Enhanced Viewer | JeetBot,” reportedly transmits these bearer credentials to proxy servers operated by a Russian commercial bot service.

Security researcher Kush Pandya from Socket discovered that the extension embeds code to recover the Twitch OAuth token and forwards it as an “&auth=” query parameter during network-layer redirects. Because the token is included in the URL query string, it is written in cleartext into the proxy server’s request logs.

A Twitch OAuth session token acts as a bearer credential, meaning anyone in possession of it can access the account without a password or multi-factor authentication (MFA). The exposed tokens can grant unauthorised access to a user’s chat, whispers (private messages), and account settings.

Technical Implementation and Targeting

JeetBot is described as a commercial software-as-a-service (SaaS) tool for Twitch, Kick, and VK-Live bots. While it advertises features such as ad-free experiences and region-unlocked content, it achieves this by routing video-playlist requests through operator-controlled proxy servers along with the user’s credentials.

The token redirection mechanism does not apply to all content. The extension uses a hardcoded allowlist of ten Russian-language streamer channels to exempt their sessions from token forwarding. Pandya noted that earlier versions of the software, such as version 4.8 released in January 2026, used POST requests to a dedicated token endpoint on the operator’s host, with backups on deno.dev and deno.net.

Mitigation and Token Revocation Warning

The operator of JeetBot, identified as Cyprus-based developer Aleksandr Popov, has acknowledged the security issue. An alert on the JeetBot documentation page states that version 85.8.7 of the Firefox add-on has been updated to prevent the transmission of OAuth tokens to proxy servers. A similar update for the Chrome version is reportedly under review.

Users are urged to check their installed extension version and update to 85.8.7 or later immediately. However, the developer warned that neither updating nor disabling the extension will revoke tokens that have already been transmitted to the operator. Affected users may need to take additional steps to secure their Twitch accounts, such as resetting credentials or managing active sessions, to invalidate previously stolen tokens.