Malicious Twitch Extension Exposed Tokens From 31,000 Users

Security researchers have uncovered a malicious Twitch extension, marketed as a quality-of-life tool to improve video playback, that secretly harvested active authentication tokens from more than 31,000 users. The extension was distributed via the Chrome Web Store and Firefox Add-ons marketplace, attracting tens of thousands of Chrome users and several hundred Firefox users before being detected.

While its stated aims included blocking ads and enabling high‑volume streams, the true function was to exfiltrate session credentials and relay them to third‑party proxy infrastructure.

According to the Socket Threat Research Team and accompanying telemetry, the extension monitors active streaming sessions and intercepts the authorization header when a victim loads Twitch. It then routes requests through remote proxies and attaches the user’s bearer token to the URL, resulting in the token being logged in cleartext on proxy servers’ logs.

The operators’ infrastructure appears to be operated by a commercial bot service (JeetBot) with broad Twitch host permissions, and a portion of traffic is exempted for ten Russian streamer channels. The practical consequence is that attackers can hijack accounts, access private messages, and spend or redeem channel points.

The recommended response is to remove the extension from Chrome and Firefox, revoke all active sessions, and have security teams audit endpoints for unauthorised add-ons and block known proxy endpoints used by the bot service. Businesses should review browser permissions and regularly assess extensions in use.