A browser extension named Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, is sending Twitch OAuth session tokens to a commercial bot service through proxy servers. Socket found that the extension captures users’ authorization headers, leaks tokens in cleartext logs, and recommends removing the extension and re-authenticating Twitch sessions. #TwitchEnhancedViewer #JeetBot #Twitch
Keypoints
- The extension has more than 30,000 installs in Chrome and Firefox stores.
- It is marketed as a tool for ad blocking, 1080p playback, region bypassing, and channel-point collection.
- Socket found it extracts Twitch OAuth tokens from authorization headers.
- The tokens are sent to JeetBot-operated proxy servers and logged in cleartext.
- Users are advised to remove the extension, disconnect Twitch sessions, and log in again.