The JeetBot Twitch Extension OAuth Token Leak: What Happened and How to Protect Yourself

The extension "Twitch Enhanced Viewer | JeetBot" appeared on both the Google Chrome Web Store and Mozilla Firefox Add-Ons store under the developer name HISHIMIRO. To users browsing these official stores, it looked legitimate because it had passed basic content review. However, once installed, it collected OAuth tokens (the digital keys that grant access to Twitch accounts without needing passwords) and transmitted them to proxy servers operated by a Russian commercial bot service. The tokens gave attackers the ability to take control of accounts, stream with stolen identities, or harvest account data without the owners knowing.

The extension was designed to appear as a utility that "enhanced" the Twitch viewing experience, which is why users installed it in the first place. This is the core deception: malware does not announce itself as malware. It hides behind a plausible purpose.

Once installed, the extension could read the authentication tokens stored by Twitch in the browser. These tokens are automatically generated when you log into Twitch and are used by the browser to prove to Twitch that you are who you claim to be. The extension exfiltrated these tokens to servers it controlled. From there, an attacker could use the token to access the account directly, bypassing the need to compromise the password or trigger two-factor authentication.

The leaked tokens affected approximately 31,000 users. Law enforcement and security researchers have traced the bot service infrastructure to Russia, suggesting the operation was conducted at scale and with some degree of infrastructure planning. This was not a one-off incident but a deliberate campaign to harvest credentials.

Browser extensions are dangerous because they operate with direct access to your browsing history, passwords stored in the browser, authentication tokens, and sometimes your webcam or microphone. An extension that requests broad permissions during installation can theoretically read every website you visit and extract sensitive data. The Chrome Web Store and Firefox Add-Ons store do scan extensions for obvious malware, but this scanning is imperfect and happens once, at upload time. An extension can be clean at submission and compromised later through an update, or it can hide its malicious behavior behind legitimate-looking code.

The fact that this extension made it to two major app stores indicates either that the malicious code was obfuscated well enough to evade automated detection, or that the review process cannot catch every threat. Users who assume "it's on the official store, so it must be safe" are taking an unwarranted risk.

For a content creator whose Twitch account was compromised via this extension, the consequences are immediate and severe. An attacker with a stolen token can change the account password, disable two-factor authentication, alter the channel name and description, ban all followers, delete years of stream archives, or go live with content that damages the creator's reputation. If the account had connected payment methods, the attacker could also attempt to fraudulently request payouts or modify affiliate settings.

For ordinary viewers, a compromised Twitch account exposes email addresses, viewing history, and any payment information linked to the account. Attackers can also use the account to spam other users or participate in coordinated inauthentic activity on the platform.

The safest approach is to minimize the number of extensions you install and to audit the ones you have.

1. Review your current extensions right now: in Chrome, go to chrome://extensions, and in Firefox, go to about:addons. Ask yourself whether you actually use each one.

1. Delete any extension you do not actively need. Each additional extension increases your attack surface.

1. Before installing a new extension, research it: check how many users have installed it, read recent reviews, and search the extension name alongside words like "malware" or "scam." If an extension has only a few downloads and vague reviews, skip it.

1. Prefer extensions made by well-known organizations (EFF, Tor Project, reputable antivirus vendors) over extensions by individuals or unknown companies.

1. Check what permissions the extension requests before confirming installation. If an extension that claims to just enhance video playback asks for permission to read your browsing history or access all your data on all sites, reject it.

1. Enable automatic updates for your extensions and browser so that security patches are applied quickly.

The JeetBot incident exposes a flaw in the app store review model: one-time screening at upload cannot protect against evolving threats or obfuscated malware. It also highlights why platforms like Twitch should consider revoking tokens in batches when a breach is discovered, rather than leaving tokens valid indefinitely. Some services now rotate tokens after a period of inactivity or after an extension is removed, which would reduce the window in which a stolen token is useful.

For users, the lesson is stark: do not assume that an application on an official store is safe simply because it passed review. Verify the developer, check the permissions, and maintain a skeptical stance toward tools you do not fully understand.

If you used the JeetBot extension or any similar Twitch enhancement tool, log out of all Twitch sessions immediately and change your password. Check your account activity and connected applications to see whether anything unfamiliar has accessed it. If you believe your account was compromised, contact Twitch support and enable two-factor authentication using an authenticator app rather than SMS.

Browser security is not a one-time fix. Treat your extensions the way you would treat people with keys to your house: allow access only to those you trust, verify their credentials before giving them access, and remove access the moment you no longer need them.

Source: The Hacker News (https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html)