Malware Leak at Twitch: 31,000 Users Affected

A malicious browser extension for Twitch has forwarded the OAuth tokens of nearly 31,000 users to proxy servers of a Russian commercial bot service. The extension is named "Twitch Enhanced Viewer | JeetBot" and was developed by HISHIMIRO/jeetbot.cc. The affected users are primarily active on the Google Chrome and Mozilla Firefox platforms. The vulnerability was discovered when users reported unusual activities in their Twitch accounts. The extension, which was marketed as a useful tool to enhance the Twitch experience, has proven to be harmful.

The OAuth tokens allow third parties to access users' accounts without them having to disclose their passwords. The affected OAuth tokens were forwarded to servers associated with the bot service. These servers are known to be used for various types of cyberattacks. Security researchers warn that using such extensions poses significant risks, especially when they come from unknown developers. The extension was available in the official stores of Google Chrome and Mozilla Firefox, which increased its distribution and users' trust in the tool.

Security authorities have already taken measures to stop the spread of the extension and warn the affected users. The incidents raise questions about the security of browser extensions. Users are urged to regularly check their accounts for suspicious activities and, if necessary, reset their OAuth tokens. Twitch itself has not yet issued an official statement regarding the incidents. The discovery of the vulnerability has also reignited the discussion about the need for stricter controls in the area of browser extensions.

Experts are calling for platforms like Google and Mozilla to improve their review processes for extensions to prevent such incidents in the future. Affected users should be aware that their accounts may have been compromised. It is recommended to enable two-factor authentication and report suspicious activities immediately. The security situation remains tense, as the full impact of the incident is not yet clear. The extension "Twitch Enhanced Viewer | JeetBot" is an example of the dangers posed by seemingly harmless tools.

Users should always inform themselves about the origin and ratings of extensions before installing them. Security research will continue to work intensively on analyzing the incidents. The exact number of affected users could still rise as further investigations are ongoing. Security researchers have already taken initial steps to identify the source of the malicious extension.

The situation remains dynamic, and new information is expected to be released in the coming days. The vulnerability was publicly disclosed on September 15, 2026, and reactions from the community are mixed. While some users are concerned, others show understanding for the challenges associated with the security of online platforms.