A malicious browser extension designed for Twitch has leaked OAuth tokens belonging to nearly 31,000 users. The extension, named "Twitch Enhanced Viewer | JeetBot," was distributed across browser stores, and its developer is listed as HISHIMIRO/jeetbot.cc.
The leaked tokens were transmitted to proxy servers run by a Russian commercial bot service, according to The Hacker News. This suggests the extension was built to harvest account access credentials under the guise of a legitimate viewer enhancement tool.
The compromise affects a large number of users, and the exposure of OAuth tokens could allow attackers to take over accounts without needing passwords. Affected users should revoke and rotate any tokens tied to Twitch and remove the extension immediately.
The incident underscores the risks of installing third-party extensions, especially those that request broad permissions or cross-store distribution channels.