Your Twitch login may be exposed: this one extension is leaking it to Russians

A popular Twitch browser extension promising ad-free streams has been quietly sending users’ live authentication tokens to a Russian bot service, security researchers have found.

Socket's researchers found that a popular extension trusted by thousands of Twitch users has been sending a credential capable of accessing users’ accounts to a third party.The extension, called “Twitch Enhanced Viewer | JeetBot,” is available for both Chrome and Firefox and has around 31,000 users combined.

The researchers found that the extension forwards users’ Twitch OAuth session tokens to proxy servers controlled by JeetBot, a commercial service offering bots for Twitch, Kick, and VK-Live.

A Twitch OAuth token is a live bearer credential for the account. Whoever gets hold of it may be able to act as the user without needing their password or second-factor authentication.

This means that by exploiting it, attackers could interact with chat, read and send whispers, and spend channel points.“Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure,” Socket said in the report.

The extension does what it promises. But at what cost?

The malicious extension says it provides such features as blocking ads, forcing 1080p video, unlocking streams that may be region-restricted, and automatically collecting channel points.

According to Socket, those features are real. The extension needs to route certain Twitch video requests through its own proxy infrastructure to provide some of those features.

The problem is that the extension collects users' account credentials. Socket found that the extension captures the “Authorization” header used by Twitch’s web client. The extension then extracts the OAuth token and stores it in its background worker.

When Twitch requests a video playlist, the extension redirects the request through an operator-controlled proxy and adds the user's OAuth token to the URL as an “auth=” parameter.

That means the credential is being transmitted to the proxy as part of the request itself. As the token is embedded in a URL, it can end up in server logs. “Appending the full account credential exposes far more than fetching the video requires,” Socket researchers said.

Token is sent to a Russian bot service

The default proxy identified by Socket is operated under JeetBot infrastructure.

Socket found that the extension's proxy configuration can determine which server receives the requests, meaning the operator can change the infrastructure used to handle users' traffic.

The researchers linked the extension's infrastructure to several hosts and servers, including infrastructure associated with JeetBot and other domains.

Socket said JeetBot's site identifies the operator as Popov Aleksandr Alekseevich. The extension itself is listed under the developer name HISHIMIRO on Chrome and Firefox. Socket also found Russian comments in earlier versions of the extension's code.

The token forwarding wasn't always hidden inside a Twitch video request. Socket found that older versions of the extension, including version 4.8 released in January 2026, contained code that explicitly POSTed captured OAuth tokens to a “set-token” endpoint.

The researchers identified several historical collection endpoints, including infrastructure hosted on JeetBot and Deno. Earlier extension versions were designed to send and potentially retain the captured credentials on the server.

Later versions removed the dedicated “set-token” endpoint, but the researchers found that token forwarding continued in the form of an “auth=” parameter attached to proxy requests.

Russian streamers' credentials are not harvested

Socket found a hardcoded list of ten Twitch channels of Russian streamers for which the extension does not forward the OAuth token. Some of the streamers on the list are prominent Counter-Strike personalities.

The researchers said the selective exemption is consistent with the extension's Russian- speaking audience, although the reason for choosing those particular channels is not clear.

Disclosures don't mention the token exfiltration

When users install the extension, they are not fully informed about their data collection. The privacy policy says that the extension does not collect, store, or process user data.

Also, the disclosure does not mention Twitch OAuth tokens being forwarded to third-party infrastructure. The extension's current listings were still live on both Chrome and Firefox when the researchers published their findings.

How to stay safe?

• Anyone who has installed “Twitch Enhanced Viewer | JeetBot” should remove it from Chrome or Firefox immediately.
• Users should then disconnect all active Twitch sessions and sign in again. This invalidates previously issued session tokens, including any that may have been forwarded by the extension.
• Security teams should also consider blocking the infrastructure identified by Socket and checking endpoints for both the Chrome and Firefox extension IDs.
• Extensions with broad permissions over authenticated services, combined with connections to third-party proxy infrastructure, should always be treated as a potential credential-exposure risk.

Twitch users' data allegedly on sale

The information about the malicious extension comes amid allegations that 40,000 Twitch streamers' data is up for sale.

Last week, such claims surfaced on hacker forums, with an attacker claiming to have stolen sensitive user data, including:

• Usernames
• URLs
• Emails
• Legal names
• Followers number
• Status of account verification

Cybernews examined the data sample and found no evidence that it had been taken directly from Twitch’s infrastructure. A likely scenario is that attackers abused the Twitch API, which could be accessed via an access token.

It remains unverified if these two incidents may be connected. "Twitch API requests can be sent with user OAuth tokens," said our research team.

"However this does not necessarily prove that the data scraping we investigated previously was caused by this specific incident," they added.

According to researchers, OAuth token can in theory be received by logging into an account.

"OAuth token could have received by using someone's stolen credentials as well, for example from infostealer combolists, so we can't know for sure," said researchers.