The Twitch Enhanced Viewer OAuth Token Breach: How a Malicious Extension Compromised 31,000 Accounts

The extension "Twitch Enhanced Viewer | JeetBot" was distributed across both Google Chrome Web Store and Mozilla Firefox Add-Ons, making it available to users across multiple browsers. Once installed, the extension silently extracted OAuth tokens—the authentication credentials that allow applications to access a user's Twitch account without needing the plaintext password—and transmitted them to proxy infrastructure operated by a Russian botnet service. OAuth tokens are more valuable to attackers than passwords because they remain valid until explicitly revoked and grant immediate account access without triggering failed login alerts that a password attempt would generate.

The developer listed on the extension was "HISHIMIRO/jeetbot.cc," which directly references jeetbot.cc, a known commercial bot-for-hire service. This naming convention suggests the operator had no intention to hide the connection and may have been relying on the difficulty users face in distinguishing between legitimate and fraudulent extensions before installation.

OAuth tokens are session credentials that act as temporary keys to a user's account. Unlike passwords, they cannot be used to change account settings directly through Twitch's login interface; they must be used programmatically through the Twitch API. This means an attacker with a stolen token can perform actions on behalf of the account owner—such as streaming, changing channel settings, accessing subscriber data, or using the account to spam or harass other users—without the owner necessarily noticing immediately through typical login notifications.

When a user installs a browser extension, they grant it permission to read and modify data on websites, including authentication cookies and API tokens stored in local browser storage. The extension operates within the browser context, giving it the same level of access to sensitive data as the user themselves possess. This is why permission prompts for browser extensions are crucial, yet many users skip reading them entirely during installation.

The attack chain begins with user action: a person searches for a Twitch enhancement tool, finds "Twitch Enhanced Viewer" in an official app store, assumes it is legitimate because it appears there, and installs it. Once active, the extension intercepts OAuth tokens—either by reading browser local storage, inspecting network traffic, or hooking into the Twitch authentication flow. The tokens are then exfiltrated to a proxy server, likely to obscure the final destination and make attribution harder.

From the attacker's perspective, stolen tokens are commodities. They can be used for automated abuse (spam, harassment, botted views or followers), sold to other threat actors, or leveraged for credential stuffing attacks on users who reuse credentials across platforms. Botnet services like jeetbot.cc specialize in artificial engagement fraud and account compromise automation, so stolen Twitch tokens fit directly into their business model.

Both Google Chrome Web Store and Mozilla Firefox Add-Ons require extension developers to go through an automated submission and review process, but human review of extension code is not guaranteed, and malicious code can be subtle or obfuscated. Extensions are frequently approved with requested permissions that seem excessive only to users who read carefully. The extension in this case apparently remained available across stores for an unknown duration before being removed, allowing thousands of users to install it before the compromise was detected.

This echoes a broader pattern: malicious extensions get uploaded to official stores, gain small but significant user bases before removal, and cause damage during the window of availability. Users often do not revisit extensions to check their status or remove ones they no longer use actively.

If you installed "Twitch Enhanced Viewer | JeetBot," here are the steps to take now:

1. Remove the extension immediately from your browser (Chrome: Settings > Extensions; Firefox: Add-ons > Extensions).
2. Log out of Twitch completely in all open browser tabs and sessions.
3. Log back in using your password (if you have not changed your Twitch password recently, do so now).
4. Check your Twitch account settings for any authorized third-party applications or connected services you do not recognize and revoke them.
5. Review your account activity log (if available) for actions you did not perform, such as streams started or settings changed.
6. Change the password for any other online accounts that share the same or a similar password to your Twitch account.

These steps will invalidate the stolen tokens (logging out revokes active sessions), change your authentication credentials, and help you regain full control of the account. Twitch may also have identified and invalidated tokens on their end as part of incident response, but you cannot rely on that without confirmation from the platform.

Browser extensions are powerful tools but carry real risk. Before installing any extension, read the permission request carefully and ask yourself whether the extension actually needs each permission it asks for. A video player enhancement does not need permission to read all your data on all websites. Check reviews and installation count; a very new extension with few installations and no reviews is a warning sign. Uninstall extensions you no longer use actively, and periodically revisit your installed extensions to remove ones you have forgotten about.

For high-security scenarios—such as streaming your Twitch account or managing a channel with significant audience—consider using a separate browser profile dedicated to Twitch, with minimal extensions installed. This compartmentalization reduces the blast radius if one extension is compromised. Keep your browser and extensions up to date, as security patches are released regularly.

This incident demonstrates that official app stores are not perfect gatekeepers and that user vigilance remains the strongest defense. It also highlights why OAuth tokens should be treated with the same care as passwords. For ordinary Twitch users, the primary risk is account hijacking for abuse or fraud purposes; for streamers and content creators with larger audiences, the risk extends to channel takeover and reputational damage. The botnet service angle suggests the stolen tokens may be used at scale for artificial engagement fraud, which degrades the integrity of Twitch's platform metrics.

For the security community, this reinforces the need for better extension sandboxing, clearer permission explanations, and more rigorous code review processes in app stores. It also underscores why two-factor authentication on Twitch is essential—even if a session token is stolen, 2FA prevents a full account takeover if the attacker tries to change the password.

Did I get my token stolen if I installed the extension

Not necessarily. The extension was available for an unknown period before removal. If you installed it within the active window and your account received an OAuth token during that time, it was likely captured. However, removal of the extension now and revocation of sessions will protect you going forward.

Can a stolen OAuth token be used to change my Twitch password

OAuth tokens do not grant password-change permissions through the Twitch web interface. However, tokens can be used to make API calls that perform account actions. If you suspect compromise, log out and change your password immediately to invalidate all active sessions.

What should I do if I notice unusual activity on my Twitch channel after installing this extension

Review your account activity log for unauthorized actions (streams, settings changes, follower additions). Immediately remove the extension, change your password, revoke all active sessions, and contact Twitch support if you see evidence of compromise such as unusual broadcaster activity or unauthorized integrations.

Are other Twitch extensions safe to install

No extension is risk-free, but risk varies. Favor extensions from developers with established presence, high install counts, and recent positive reviews. Always read permission requests and avoid extensions that ask for excessive permissions relative to their stated function. Consider whether the extension is truly necessary or whether browser-native features could accomplish the same task.

Should I use two-factor authentication on Twitch

Yes. Even if a session token is stolen, 2FA prevents an attacker from gaining full control by changing your password or account recovery settings. Enable 2FA on any Twitch account you use for streaming or that has personal value.

Source: The Hacker News