A Chrome and Firefox extension marketed as a Twitch quality-of-life tool, adding ad blocking, forced 1080p playback, and automatic channel-points collection, has been quietly forwarding users’ account session tokens to an operator-controlled proxy, according to research published September 11 by Socket’s threat research team. The extension, “Twitch Enhanced Viewer” (also distributed under the name JeetBot), reached roughly 30,000 Chrome users and 552 Firefox users, with both listings still live at the time Socket published its findings.
A content script captures the Authorization header Twitch’s own web client uses, strips it to the raw OAuth session token, and appends that token as an &auth= query parameter when the extension redirects a routine video-playlist request through the operator’s proxy domain, where it sits in plain text in the proxy’s request logs. As Socket researcher Kush Pandya put it, “A Twitch OAuth session token is a bearer credential: whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points.”
Why it matters for the security leader: this is a browser-extension supply chain problem wearing a streaming skin. The pattern, legitimate functionality as cover, a token intercepted at the network layer, and a proxy redirect most tooling reads as ordinary CDN traffic, works against any platform whose extension ecosystem is loosely policed. Enterprises that let employees install browser extensions on managed devices, particularly SSO-linked browser profiles, face the same exfiltration path, the session-hijacking logic CyberTech tracked in this month’s M365 phishing campaign and last week’s passkey-themed account hijacks.
The original insight sits in the extension’s own history: Socket notes earlier builds from January 2026 POSTed stolen tokens directly to a dedicated collection endpoint, a crude, detectable pattern. The current version instead hides the token inside a parameter on what looks like a normal video-request redirect, evidence the operator adapted specifically to blend into legitimate traffic rather than to dodge one detection rule, a sign extension-based token theft is maturing past the point a simple network rule catches it.
Source: Socket
