Security 1 publisher2 min readPublished September 14, 2026 at 2:20 AM PDT

Twitch extension in both browser stores forwards 30,604 users' live OAuth tokens to operator proxies

Socket found that Twitch Enhanced Viewer | JeetBot attaches viewers' live OAuth tokens to playlist requests routed through its operator's proxies, exempting ten Russian-language channels. The Firefox fix has shipped and the Chrome build is in review.

The Watch · Security desk

Illustration accompanying Twitch extension in both browser stores forwards 30,604 users' live OAuth tokens to operator proxies

What happened

Twitch Enhanced Viewer | JeetBot has 30,000 installs on the Chrome Web Store since June 26, 2025 and 604 on Firefox since July 7, 2025, and both listings were still downloadable when Socket published.
Socket says the extension relays viewers' live authenticated Twitch sessions through proxy servers run by its operator, a commercial bot service selling to Twitch, Kick and VK Live streamers.
Because the credential rides in the URL query string, it is written in cleartext into the operator proxy's request logs.
A hardcoded allowlist exempts ten Russian streamer channels, and watching any other channel forwards the viewer's live token to the proxy.
The developer's notice warns that disabling or updating the extension does not revoke tokens it has already transmitted.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure Removing the extension stops future forwarding and leaves the logged credential usable. For these accounts, exposure ends when the Twitch session behind the token is invalidated.
constraint Firefox users can close this themselves now. The 30,000-install Chrome side waits on Google's review queue before a fixed build exists to install.
capability The hardcoded exemption shows the forwarding can be filtered per channel, and the operator picked the ten channels on the list.
decision The token left under Twitch host permissions granted at install. Organisations whose staff run brand channels can block that install by allowlisting extensions in the managed browser.

The extension advertises an ad-free stream and region-unlocked playback. It delivers that by routing Twitch's video-playlist requests to usher.ttvnw.net through operator-controlled proxy servers, with the viewer's OAuth token attached ^[5]. "Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket security researcher Kush Pandya said ^[6]. The token opens the account's chat, whispers and settings ^[9].

The delivery method has changed at least once while both listings stayed up. "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net," Pandya said ^[10]. The Chrome listing went up on June 26, 2025 and the Firefox add-on on July 7, 2025 ^[2]^[3]. That leaves the Chrome build on the store for about 14 months before Socket published ^[2].

The exemption list mixes tiny channels with very large ones: three of the ten have fewer than 30 followers, dosia with 29, almazer with 4 and fander with 2, while akyuliych has 1.1 million and pch3lk1n 580,000 ^[11]^[3].

JeetBot sells itself as a bot for Twitch, Kick and VK Live and claims more than 26,000 active streamers and 1 billion processed messages ^[13]. The site footer credits a Cyprus-based developer, Aleksandr Popov, whose LinkedIn profile calls JeetBot a pet project ^[14]. The Hacker News described the proxy servers as operated by a Russian commercial bot service ^[15]. It said it had asked Socket and the developer for comment and had not heard back ^[16].

The developer has posted an alert on JeetBot's documentation page. "Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies," it says, and "Older installations using the previous mechanism continue to send the token until updated" ^[17]^[18]. The Firefox add-on has 85.8.7; the alert says an equivalent Chrome version is under review ^[19]. Users who cannot get the update are told to disable the extension to stop further transmission ^[20].

What to watch

Whether Google approves the Chrome build that stops the token forwarding, or pulls listing pnhhdhhcadcjfckjhpmjneldiegbojfb instead.
Whether Twitch invalidates sessions for accounts whose tokens reached the operator's proxies, and says so publicly.
Any statement from Socket or the developer on how long the proxy request logs retained the tokens, and who could read them.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The extension is named "Twitch Enhanced Viewer | JeetBot" and lists HISHIMIRO/jeetbot.cc as its developer.
ReportedSupportedView cited source
[2]
On the Google Chrome Web Store the extension has the identifier pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users, and was published on June 26, 2025.
ReportedSupportedView cited source
[3]
On the Mozilla Firefox Add-Ons store the extension has the identifier [email protected], 604 users, and was published on July 7, 2025.
ReportedSupportedView cited source
[4]
Both the Chrome and Firefox extensions were still available for download as of the Socket writeup.
ReportedSupportedView cited source
[5]
The extension claims to offer an ad-free experience and region-unlocked content, and does so by routing Twitch's video-playlist requests to usher.ttvnw.net through operator-controlled proxy servers along with the user's OAuth token as an "&auth=" query parameter.
ReportedSupportedView cited source
[6]
Socket security researcher Kush Pandya said: "Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy."
ReportedSupportedSource: Kush Pandya, SocketView cited source
[7]
Pandya said: "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."
ReportedSupportedSource: Kush Pandya, SocketView cited source
[8]
Because the token is placed in the URL query string, it is written in cleartext into the proxy server's request logs.
ReportedSupportedView cited source
[9]
The token can enable access to a user's chat, whispers (private messages), and account settings.
ReportedSupportedView cited source
[10]
Pandya said: "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net."
ReportedSupportedSource: Kush Pandya, SocketView cited source
[11]
Follower counts for the ten exempted channels: pch3lk1n 580K, fasoollka 361K, flamie 132K, dosia 29, fander 2, almazer 4, forzorezor 177K, akyuliych 1.1M, lagoda1337 225K, lagoda 77.3K.
ReportedSupportedView cited source
[12]
Socket said: "The operator is a commercial Twitch, Kick, and VK-Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure."
ReportedSupportedSource: SocketView cited source
[13]
JeetBot advertises itself as a bot for Twitch, Kick and VK Live and claims to have over 26,000 active streamers and 1 billion processed messages.
ReportedSupportedView cited source
[14]
The JeetBot site's footer identifies the operator to a Cyprus-based developer named Aleksandr Popov, whose LinkedIn profile claims JeetBot is their pet project.
ReportedSupportedView cited source
[15]
The Hacker News described the leaked OAuth tokens as going to proxy servers operated by a Russian commercial bot service.
ReportedSupportedSource: The Hacker NewsView cited source
[16]
The Hacker News said it had contacted both Socket and the developer for further comment and would update its story on a response.
ReportedSupportedView cited source
[17]
The JeetBot documentation alert states: "Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies."
ReportedSupportedSource: JeetBot documentationView cited source
[18]
The JeetBot documentation alert states: "Older installations using the previous mechanism continue to send the token until updated."
ReportedSupportedSource: JeetBot documentationView cited source
[19]
The alert says version 85.8.7 of the Firefox add-on addresses the problem and that an equivalent Chrome version is currently under review.
ReportedSupportedView cited source
[20]
The documentation urges users to temporarily disable the extension to halt further transmission of the token if the updated extension is not available.
ReportedSupportedView cited source
[21]
The developer warned that disabling or updating the extension does not revoke previously transmitted tokens.
ReportedSupportedView cited source
[22]
Socket said: "Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure."
ReportedSupportedSource: SocketView cited source
[23]
The Hacker News account of Socket's findings was published in September 2026.
ReportedSupportedView cited source
[d1]
The two store listings total 30,604 installs.
DerivedSupported1 source— sign in to open
[d2]
The Chrome listing was live for roughly 14 months before Socket's findings were published.
DerivedSupported1 source— sign in to open
[d3]
Three of the ten exempted channels have fewer than 30 followers.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

thehackernews.com
1 article · September 14, 2026
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The technical detail all sits in one place. Socket's Kush Pandya says current v85.x builds attach the viewer's live token to the playlist request as an "&auth=" query parameter on a network-layer redirect, which puts a bearer credential into the proxy's access logs in cleartext. Earlier v4.x builds did it more directly, POSTing the token to a set-token endpoint on the operator host with backups on deno.dev and deno.net. The exemption list is the odd artifact: ten Russian-language channels whose sessions are left alone, seven of them large and three with fewer than 30 followers each. JeetBot's own documentation now says playlists are fetched without the token from 85.8.7 onward, which is the closest thing to confirmation this story has.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence66

0100

One researcher, checkable specifics

Everything traces to Socket's write-up as relayed by The Hacker News, and nobody has re-run the analysis. What holds it up is that the details are the sort a reader can check: two store identifiers, a version string, a query parameter, ten named channels. The firmest corroboration comes from the accused party, whose documentation now says the token used to go to its proxies and stopped doing so in 85.8.7.

Adoption68

0100

30,604 installs, no telemetry

The exposure count is two listing pages added together: 30,000 on Chrome, a number the store rounds, plus 604 on Firefox. Socket's "approximately 31,000" is those two figures. There is no measure of how many installs were active, and no count of tokens actually written to proxy logs. JeetBot's separate claim of 26,000 active streamers is its own marketing and covers the bot service, not the extension.

Hype gap+18

−100 understated0 aligned+100 overstated

Attribution ahead of the record

The developer's fix confirms the behaviour, so the substance holds up; it's the framing that runs harder than the evidence. The Hacker News describes the proxies as those of a Russian commercial bot service, while the only ownership detail in the story is a Cyprus-based developer named in the site footer, with the Russian connection resting on the language of the ten exempt streamers. A headline count of nearly 31,000 users also treats a rounded install figure as a tally of victims.

Incentives58

0100

Vendor research meets vendor patch note

Socket's business is scanning third-party code, and disclosures like this are how it gets read; the saving grace is that the finding is specific enough for anyone to check. JeetBot sells subscriptions to streamers and frames the change as a note about how playlists are retrieved, without saying how long the token was sent or whether any were used. Socket's line that the exposure was undisclosed in both store listings puts pressure on the stores' review process as much as on the operator.

Confidence62

0100

Behaviour settled, aftermath open

I'd treat the token forwarding and the Firefox fix as settled, since the researcher and the operator describe the same thing. The rest is open: whether the Chrome build has cleared review since publication, whether any logged token was used, and what a user does about credentials already sent, which the developer says an update will not undo.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

build
An ad-blocking Twitch extension appends 30,000 users' account tokens to a proxy URL
1 publisher
build
77 linked Firefox add-ons, one pipeline: store review is a checkpoint, not a control
1 publisher
build
Google's CDN delivered version 1.7.3.0 of an extension it had pulled six months earlier
1 publisher
build
Socket turns on continuous scanning for all 97,100 Firefox add-ons
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources