Executive Summary
In September 2026, a malicious Twitch browser extension called 'Twitch Enhanced Viewer | JeetBot' was discovered exposing OAuth tokens from nearly 31,000 users across Chrome and Firefox platforms. The extension, developed by HISHIMIRO/jeetbot.cc and operated by Cyprus-based developer Aleksandr Popov, routed users' authenticated Twitch sessions through operator-controlled proxy servers while claiming to provide ad-free viewing and region-unlocked content. The OAuth tokens were transmitted in cleartext as URL query parameters, enabling unauthorized access to users' chat, private messages, and account settings. Interestingly, the token forwarding mechanism excluded a hardcoded list of ten Russian streamer channels with large followings.
This incident highlights the growing threat of supply chain attacks targeting browser extensions and the critical importance of OAuth token security in modern web applications. As streaming platforms and social media continue to expand globally, malicious actors are increasingly exploiting trusted software distribution channels to harvest user credentials at scale.
Why This Matters Now
Browser extension supply chain attacks are surging as threat actors exploit users' trust in popular platforms. With over 31,000 victims exposed through a single malicious extension, this incident demonstrates how easily OAuth credentials can be harvested at scale through compromised browser add-ons.
Attack Path Analysis
Attackers distributed a malicious Twitch browser extension through official stores, establishing persistence through user installation. The extension captured OAuth tokens during normal browsing, forwarded credentials to operator-controlled proxies, and exposed nearly 31,000 user accounts to potential unauthorized access including chat manipulation and account compromise.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Malicious browser extension 'Twitch Enhanced Viewer | JeetBot' published to Chrome Web Store and Firefox Add-Ons store, downloaded by 30,604 users seeking enhanced Twitch functionality
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Steal Web Session Cookie
Credentials from Password Stores: Credentials from Web Browsers
Browser Session Hijacking
Exfiltration Over C2 Channel
Proxy
Hide Artifacts: Hidden Files and Directories
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Cryptography and Security Protocols
Control ID: 3.4.1
NYDFS 23 NYCRR 500 – Third Party Service Provider Security Policy
Control ID: 500.15
DORA – ICT Third-Party Risk Monitoring
Control ID: Article 28
CISA ZTMM 2.0 – Identity and Access Management
Control ID: Pillar 2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Entertainment/Movie Production
Streaming platforms face supply-chain vulnerabilities through malicious browser extensions that compromise OAuth tokens, enabling unauthorized access to content distribution systems and user accounts.
Computer Software/Engineering
Browser extension ecosystems demonstrate critical supply-chain risks where malicious code can exfiltrate authentication tokens, compromising developer accounts and software distribution integrity across platforms.
Marketing/Advertising/Sales
Digital advertising platforms vulnerable to OAuth token theft through compromised browser extensions, potentially exposing campaign data and enabling unauthorized access to advertising accounts.
Computer/Network Security
Security vendors must address browser extension supply-chain attacks that bypass traditional defenses, as malicious extensions can exfiltrate credentials despite existing egress filtering and monitoring solutions.
Sources
- Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Usershttps://thehackernews.com/2026/09/malicious-twitch-browser-extension.htmlVerified
- Socket Security Research: Malicious Twitch Browser Extension Analysishttps://socket.dev/blog/malicious-twitch-browser-extensionVerified
- Chrome Web Store: Twitch Enhanced Viewer JeetBot Extensionhttps://chromewebstore.google.com/detail/twitch-enhanced-viewer-je/pnhhdhhcadcjfckjhpmjneldiegbojfbVerified
- JeetBot Documentation: Extension Security Updatehttps://docs.jeetbot.cc/en/base-stuff/extension/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have reduced the blast radius of this browser extension compromise by constraining lateral access across cloud workloads and limiting the scope of token-based authentication abuse through segmented network controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF visibility would likely have detected anomalous network patterns from compromised endpoints attempting to reach cloud infrastructure, constraining the extension's ability to establish persistent communication channels with backend services.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely have constrained the extension's ability to leverage stolen OAuth tokens across multiple cloud services and workloads, limiting the scope of privileged access even after credential compromise.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have limited the attacker's ability to move between different service tiers and user data repositories, constraining access to sensitive communication channels and account management functions.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely have detected the proxy redirection patterns and constrained the extension's ability to establish covert communication channels through legitimate service endpoints across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely have constrained unauthorized data transmission to external proxy servers, reducing the volume of OAuth tokens successfully exfiltrated from cloud infrastructure to attacker-controlled endpoints.
Residual impact would likely be constrained to a smaller subset of user accounts with limited cross-service access, as segmentation controls would have reduced the blast radius of token abuse across interconnected cloud workloads and services.
Impact at a Glance
Affected Business Functions
- Content Streaming Services
- User Authentication Systems
- Digital Content Distribution
- Social Media Platform Operations
Estimated downtime: N/A
Estimated loss: N/A
OAuth tokens from approximately 31,000 Twitch users compromised, enabling unauthorized access to user chat, private whispers, and account settings. Tokens transmitted in cleartext to Russian-operated proxy servers.
Recommended Actions
Key Takeaways & Next Steps
- • Implement egress security controls to detect and block unauthorized OAuth token transmission in URL parameters to external proxy servers
- • Deploy multicloud visibility solutions to monitor suspicious browser extension traffic patterns and anomalous authentication flows
- • Establish zero trust segmentation to limit application-to-internet communications and prevent credential forwarding to unauthorized destinations
- • Enable threat detection capabilities to baseline normal authentication patterns and alert on OAuth token abuse or session anomalies
- • Configure cloud firewall policies with URL filtering to block known malicious proxy infrastructure and unauthorized credential forwarding endpoints
