Twitch JeetBot extension leaks OAuth tokens for 31k users

Socket Threat Research documented a Chrome and Firefox extension, Twitch Enhanced Viewer | JeetBot, that forwards each user's live Twitch OAuth session token through proxies run by a commercial bot service. The 11 September write-up is a technical analysis of a third-party store extension, not a Twitch platform breach. The Chrome Web Store listing (ID pnhhdhhcadcjfckjhpmjneldiegbojfb) showed about 30,000 users. Firefox Add-ons showed about 552 users. Both listings were live when Socket published.

The extension markets itself as an ad-block, 1080p, region-unlock, and channel-points helper. To deliver video, current v85.x builds redirect Twitch playlist requests (usher.ttvnw.net) through operator-controlled proxies and append the user's Twitch OAuth token as an &auth= query parameter.

Socket shows that token is the account-scoped OAuth credential (chat, whispers, account settings), not a narrow stream-playback token. The extension validates it against Twitch's own token-validation endpoint with an Authorization: OAuth header. The token is forwarded for every channel watched except a hardcoded allowlist of ten Russian streamer channels.

The operator is described as a commercial Twitch, Kick, and VK Live bot SaaS that relays live authenticated sessions through its infrastructure. Developer credit on the stores is HISHIMIRO / jeetbot.cc. Earlier builds collected tokens more outright, including a POST to a set-token endpoint. Socket maps the capture path through content.js and background.js, with a default proxy at enhanced.jeetbot.cc, a forced-strip proxy at morphilina.me, and a proxy catalog at ext-styles.jeetbot.cc.

The Hacker News later put the Firefox listing at 604 users and said both stores still offered the add-on as of 14 September. The operator told that outlet the token forwarding was an oversight, that Firefox 85.8.7 stops sending the OAuth token to proxies, and that a Chrome build was still in store review. Socket's 11 September analysis treated then-current v85.x listings as still appending the token. The same credential-theft pattern sits behind Microsoft passkey lures into Microsoft 365 cloud theft.

Some offers on this page may be paid placements or contain affiliate links.