Malicious JeetBot extension leaks OAuth tokens of nearly 31,000 Twitch users via proxy logs
A browser extension called JeetBot sent live Twitch OAuth tokens for nearly 31,000 users to operator‑controlled proxies by placing the credentials in request URLs, with older installs still transmitting tokens until updated.
A single browser extension has exposed the login tokens of tens of thousands of Twitch users, showing how add‑ons can undermine account security without ever breaching a platform’s own systems.
According to technical reporting, nearly 31,000 Twitch users had their live OAuth tokens sent to operator‑controlled proxies by a malicious extension dubbed JeetBot. OAuth tokens are the credentials that let services prove a user has approved access without sending a password every time. If attackers collect an active token, they can often act as that user until the token is revoked or expires.
JeetBot achieved this by embedding the tokens directly into the URLs of web requests it routed through proxies. Those URLs were then recorded in proxy logs under the control of whoever ran the infrastructure behind the extension. Because the tokens were live, the operators potentially gained the ability to reuse them to access accounts or connected services.
The problem is ongoing for anyone who hasn’t removed or updated the extension. Older installations continue sending tokens to the proxies, extending the window during which credentials can be harvested.
For Twitch creators and viewers who installed JeetBot, the incident illustrates how much trust is placed in third‑party tools that promise to improve streaming or viewing. In practice, the security of their accounts now depends not only on Twitch’s own defenses but also on the behavior of code running in their browsers.
Key steps to watch from here include whether Twitch forces token resets for affected users, how browser vendors treat JeetBot in their extension stores, and whether investigators see signs the stolen tokens have been used at scale.
Sources
- OSINT