Socket’s Threat Research Team found that the cross-store browser extension “Twitch Enhanced Viewer | JeetBot” forwards users’ live Twitch OAuth session tokens to operator-controlled proxy infrastructure, exposing account-scoped credentials across Chrome and Firefox. Earlier versions even POSTed the token to a dedicated set-token endpoint, and the operator’s infrastructure is tied to the JeetBot commercial Twitch, Kick, and VK-Live bot service. #TwitchEnhancedViewer #JeetBot #ChromeWebStore #FirefoxAddons
Keypoints
- Socket identified “Twitch Enhanced Viewer | JeetBot” as a browser extension that forwards live Twitch OAuth session tokens to proxy servers controlled by the operator.
- The extension is available in both the Chrome Web Store and Firefox Add-ons, with about 30,000 Chrome users and 552 Firefox users at the time of reporting.
- Current v85.x builds append the token as an
&auth=query parameter when redirecting Twitch video requests through the proxy. - Earlier v4.x builds, including version 4.8, POSTed the captured token directly to a
set-tokenendpoint on the operator’s infrastructure. - The extension claims to improve Twitch viewing by blocking ads, forcing 1080p, unlocking regions, and auto-collecting channel points, which masks the token forwarding behavior.
- A hardcoded allowlist of ten Russian streamer channels is exempt from token forwarding, while all other channels route the user token to the proxy.
- The exposed token is a full account-scoped Twitch OAuth credential, meaning it can be used to access chat, whispers, account settings, and other authenticated actions.
MITRE Techniques
- [T1176 ] Browser Extensions – The attacker logic is embedded in a cross-store browser extension that captures and forwards credentials (‘the content script reads the Authorization header… and relays it to the extension background worker’).
- [T1539 ] Steal Web Session Cookie – The extension exfiltrates the user’s live Twitch session credential, effectively stealing an authenticated web session token (‘the user’s Twitch OAuth token rides along on that redirect’).
- [T1557 ] Adversary-in-the-Middle – The extension proxies Twitch video playlist traffic through operator-controlled infrastructure while carrying the authentication token (‘redirects Twitch’s video-playlist requests through operator-controlled proxy servers’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The token is sent over normal HTTPS web traffic and embedded in URL parameters and POST requests (‘forwards the token inline as an &auth= query parameter’ and ‘POSTing the token to a dedicated set-token endpoint’).
Indicators of Compromise
- [Extension IDs ] browser extension identifiers – pnhhdhhcadcjfckjhpmjneldiegbojfb, [email protected]
- [Domains ] operator-controlled proxy and configuration hosts – enhanced.jeetbot.cc, api.jeetbot.cc, ext-styles.jeetbot.cc, proxy.morphilina.me, and 2 more domains
- [IP addresses ] infrastructure resolving to operator servers – 152.53.177.186, 132.243.113.25, and 80.74.26.162
- [Historical endpoints ] former token collection URLs – enhanced.jeetbot.cc/set-token, thebeholder-proxy.deno.dev/set-token, and proxy.thebeholder.deno.net/set-token
- [File hashes ] extension package hashes – SHA-256 e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8, SHA-256 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc
- [Email addresses ] operator and developer contact points – [email protected], [email protected]
- [Other identifiers ] related operator and developer names – Popov Aleksandr Alekseevich, HISHIMIRO, alexue4.dev
Read more: https://socket.dev/blog/malicious-twitch-browser-extension