Particle.news

Twitch Extension Routed 31,000 Users' OAuth Tokens Through Russian Proxy Network

Exposed bearer tokens let anyone act on accounts without a password; users must revoke Twitch sessions to invalidate them.

Overview

  • Socket researchers published findings on Sept. 11 showing the cross-store extension “Twitch Enhanced Viewer | JeetBot” forwarded account-scoped OAuth tokens through operator-controlled proxies.
  • The extension appended live Twitch OAuth tokens as an &auth= URL query parameter so the tokens were written in cleartext to proxy request logs and could be captured by the proxy operator.
  • Earlier v4.x builds went further by POSTing captured tokens to a dedicated set-token endpoint on JeetBot infrastructure with backups on two Deno services, creating persistent storage of credentials.
  • The code contained a hardcoded allowlist that exempted ten Russian-language channels from token forwarding, a design detail Socket says suggests intentional behavior rather than accidental leakage.
  • The developer issued Firefox update v85.8.7 to stop forwarding and submitted a Chrome fix for review but Socket and reporters warn users to remove the extension and revoke all Twitch sessions to fully mitigate exposure.