Threat Intelligence

Fake Twitch 'Enhancement' Extension Steals Account Tokens From 31,000 Users

The Hacker News · 14 Sept 2026

Key Takeaway Review and restrict browser extensions on work devices, and avoid installing add-ons that promise free premium features, as they may be harvesting account credentials in the background.

A browser extension marketed as a way to unlock ad-free, high-quality Twitch streaming has instead been quietly stealing user account tokens. Known as "Twitch Enhanced Viewer | JeetBot," the extension is still available on both the Chrome Web Store and Firefox Add-Ons store. It promises features like 1080p streaming in restricted regions, but researchers found it routes video requests through proxy servers controlled by a commercial Russian bot service, attaching the user's Twitch OAuth token to each request.

That token can grant access to a victim's chat, private messages and account settings. Because it is sent as plain text in a web address, it ends up stored in cleartext in the proxy operator's server logs, an easy target if those logs are ever exposed or misused. Notably, the extension exempts ten specific Russian-language streamer channels from this token forwarding, suggesting a deliberate design choice by its operators. Earlier versions of the extension reportedly sent tokens directly to a dedicated collection server rather than through the streaming redirect.

This case highlights a growing risk for businesses: employees using seemingly harmless browser extensions on work devices can unknowingly expose account credentials to third parties. Extensions with broad permissions, especially those promising to unlock premium or restricted content for free, deserve extra scrutiny before installation.

browser extension OAuth Twitch credential theft data leak

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.