A cross-store Twitch browser extension has reportedly been exposing the OAuth session tokens of nearly 31,000 users, sending the credentials to proxy servers operated by a Russian commercial bot service.
The extension, called “Twitch Enhanced Viewer | JeetBot,” was available through both the Google Chrome Web Store and Mozilla Firefox Add-ons marketplace at the time of reporting.
Security researchers say the extension forwards users’ Twitch OAuth tokens through operator-controlled proxy infrastructure whenever they watch most Twitch channels.
Nearly 31,000 Chrome and Firefox Users Affected
According to security researchers at Socket, the extension has been distributed through two major browser extension stores:
- Google Chrome:
pnhhdhhcadcjfckjhpmjneldiegbojfb— approximately 30,000 users - Mozilla Firefox:
twitchenhancedviewer@example.com— approximately 604 users
The Chrome extension was published on June 26, 2025, while the Firefox version appeared on July 7, 2025.
The extension describes itself as a tool designed to improve the Twitch viewing experience, claiming to provide features such as ad-free viewing and access to 1080p streams in regions where higher-quality video may otherwise be restricted.
Its listing states that JeetBot is a tool for Twitch streamers and viewers focused on “quality, convenience, and control.”
However, researchers say the extension’s implementation creates a significant security risk.
OAuth Tokens Sent to Operator-Controlled Servers
Socket security researcher Kush Pandya found that current versions of the extension, including the 85.x builds, retrieve the user’s Twitch OAuth token and forward it to a proxy operated by the extension’s developer.
The token is reportedly included directly in a URL as an &auth= query parameter when Twitch video playlist requests are redirected through the proxy.
This means that when a user watches a Twitch channel, the extension can transmit their active OAuth credential to infrastructure controlled by the operator.
“Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator’s proxy.”
The forwarding mechanism reportedly applies to virtually every Twitch channel, with one notable exception: a hard-coded allowlist of 10 channels.
Why Exposing an OAuth Token Is Dangerous
A Twitch OAuth token functions as a bearer credential. In practical terms, whoever possesses a valid token may be able to perform certain actions on the associated Twitch account without knowing the user’s password or bypassing the need for a second authentication factor.
Depending on the token’s permissions, this can potentially include:
- Reading and sending Twitch whispers (private messages)
- Posting messages in Twitch chats
- Accessing account-related functionality
- Spending channel points
- Performing other actions permitted by the session
The exposure is particularly concerning because the token is reportedly placed directly into the URL used to access Twitch video playlists.
Tokens Could Appear in Proxy Logs
Putting authentication credentials into URL query parameters introduces another potential security problem.
URLs are commonly recorded in server and proxy logs. As a result, the OAuth token may be stored in plaintext within the operator’s request logs.
This could create an additional avenue for unauthorized access if those logs are exposed, compromised, retained insecurely, or accessed by unauthorized parties.
According to Pandya, earlier 4.x versions of the extension went even further. For example, version 4.8, released in January 2026, reportedly sent the token via a POST request to a dedicated set-token endpoint hosted by the operator, with additional infrastructure hosted on Deno domains.
Ten Twitch Channels Were Excluded
Researchers discovered that the extension contains a hard-coded list of 10 Twitch channels whose viewers’ tokens are reportedly excluded from the forwarding mechanism.
The channels identified by Socket include:
- pch3lk1n — approximately 580,000 followers
- fasoollka — approximately 361,000 followers
- flamie — approximately 132,000 followers
- dosia — approximately 29 followers
- fander — approximately 2 followers
- almazer — approximately 4 followers
- forzorezor — approximately 177,000 followers
- akyuliych — approximately 1.1 million followers
- lagoda1337 — approximately 225,000 followers
- lagoda — approximately 77,300 followers
Most of the channels on the allowlist are Russian-language streamers.
“For every channel outside this list, the user’s live token is forwarded to the proxy,” Pandya explained.
JeetBot Operates as a Commercial Streaming Bot Service
JeetBot presents itself as a commercial bot platform supporting Twitch, Kick and VK Live.
The service advertises features including message speech synthesis, automatic translation and other tools intended to improve interaction between streamers and viewers.
The website claims to have more than 26,000 active streamers and to have processed over 1 billion messages.
Its website footer identifies a Cyprus-based developer named Aleksandr Popov as the operator. On LinkedIn, Popov reportedly describes JeetBot as a personal project.
Developer Releases a Fix
Following the discovery, the JeetBot documentation was updated with an alert acknowledging the OAuth-token issue.
The developer says Firefox version 85.8.7 changes the way Twitch playlists are retrieved so that users’ OAuth tokens are no longer sent through JeetBot’s proxy servers.
An equivalent Chrome update was reportedly still under review at the time.
The documentation warns users to check their installed extension version and update to 85.8.7 or later.
Users who cannot immediately update are advised to temporarily disable the extension to stop further token transmission.
Updating the Extension May Not Be Enough
There is an important distinction between stopping future exposure and protecting a token that has already been transmitted.
Disabling or updating the extension does not automatically revoke OAuth tokens that were previously sent to the operator’s infrastructure.
Users who believe they were affected should therefore consider revoking their Twitch sessions or OAuth credentials through Twitch’s account security controls and then signing back in as necessary.
This is particularly important for anyone who used the extension before installing a fixed version.
What Users Should Do
If you have installed Twitch Enhanced Viewer | JeetBot, consider taking the following steps:
- Check the installed extension version.
- Update to version 85.8.7 or later where the fixed version is available.
- Disable the extension if you cannot update it immediately.
- Revoke potentially exposed Twitch sessions or OAuth credentials.
- Review your Twitch account activity for unusual messages, chats or other actions.
- Avoid reinstalling older versions of the extension.
Users should also be cautious with browser extensions that request broad permissions or route authenticated traffic through third-party servers, particularly when the security implications are not clearly disclosed.
Socket Warns of Widespread Token Exposure
Socket estimates that approximately 31,000 Chrome and Firefox users have had their live Twitch OAuth session tokens routed through infrastructure controlled by the JeetBot operator.
The security firm characterized the token as a bearer credential capable of allowing someone who obtains it to act on the user’s Twitch account without their password or second factor.
At the time of the report, Socket said the OAuth-token forwarding behavior had not been disclosed in the extension’s store listings.
The Hacker News reported that it contacted both Socket and the JeetBot developer for additional comment. Further information may emerge as the investigation continues.
Bottom line: If you have ever installed Twitch Enhanced Viewer | JeetBot, updating or disabling the extension is only part of the response. Because previously transmitted OAuth tokens may remain valid, affected users should also take steps to revoke potentially compromised credentials.
