JeetBot Extension Exposes 31K OAuth Tokens on Twitch

How a Harmless Extension Became Collection Infrastructure

The Socket Threat Research Team published a technical report on Monday, September 14, detailing the "Twitch Enhanced Viewer | JeetBot" browser extension that routes Twitch session OAuth tokens to proxy servers operated by a Russia-based commercial bot service. The extension has 30,000 installs on the Chrome Web Store and 552 on Firefox Add-ons, functioning this way since version 4.8, released in January. In both stores, the product page states that the developer "does not collect or use user data." According to Socket, this statement is false and contradicts the runtime behavior of version 85.x, currently being distributed.

What the Token Allows

The captured credential is not a playback token with a restricted scope; it is the full OAuth token of the account. Whoever possesses this token, without requiring a password or 2FA, can read and send whispers on the platform, participate in chat as the account holder, change account settings, and spend channel points. With a base of 31,000 accounts, this mechanism allows for everything from manipulating subscription markets to social engineering against large-audience streamers. What concerns the corporate CISO is not Twitch itself, but the pattern: an extension with a declared legitimate purpose, distributed through official channels of the two largest browser stores, captured credentials for nine months before any public alert.

The Disguise and the Russian Exception

The extension delivers what it promises: it blocks ads on Twitch, forces 1080p quality, unlocks region-restricted streams, and automatically collects channel points. This delivery acts as a disguise, which is why the user base has grown. The detail tying the attribution is the allowlist encoded within the binary: ten channels of Russian streamers are exempt from token forwarding, meaning that when users watch these channels, their session is not captured. This is a classic signature of dual-use operations, both commercial and intelligence-related. The captured traffic exits through three endpoints: one /set-token path in the JeetBot infrastructure and two secondary ones hosted on deno.dev and deno.net, with Deno being a serverless platform that complicates infrastructure attribution via reverse lookup.

Twitch, Google, and Mozilla Have Not Confirmed

As of the publication of this article, neither Twitch, Google, nor Mozilla had publicly commented on the extension. There is also no regulatory confirmation, and the technical disclosure relies entirely on Socket's report. This is not insignificant: the typical interval between disclosure and removal of a malicious extension from the two stores is 24 to 72 hours. If these 72 hours pass without removal, the corporate reading changes because the extension continues to distribute the current payload, and the OAuth token continues to traffic to servers outside the jurisdiction of any Western regulator.

What This Means for Corporate Security Teams

No CISO regulates which extensions an employee installs on their personal browser, but all regulate what runs within the corporate perimeter, and this is where the pattern hits home. JeetBot is a consumer extension, but the attack mode—an extension with real utility that exfiltrates credentials in the background—follows the same pattern seen in grammar extensions, screenshot capture tools, and free VPN clients that companies still tolerate on managed machines. Two practical takeaways. First, the inventory of installed extensions on corporate endpoints must be treated like software inventory, with an allowlist and review cycle, not as a user preference. Second, revoking OAuth sessions in response to a suspicious event cannot depend on the user logging out: it must be server-side, at the identity provider. Both seem obvious, yet in audits published by Deloitte and KPMG in 2026, they remain the two most common gaps in mid-size companies in Europe and Southeast Asia.