Twitch extension with 30K installs exposes users’ OAuth tokens
Refract AI Intelligence Digest
BLUF
A verified browser extension is exfiltrating user authentication tokens to an external server.
NEWS
The Twitch Enhanced Viewer | JeetBot extension, found in official Chrome and Firefox stores, transmits OAuth session tokens to a commercial bot service without user consent. This affects approximately 30,000 installations across both platforms.
Why I Care
Stolen OAuth tokens allow attackers to hijack Twitch accounts, access private data, or perform actions on behalf of the victim without needing passwords.
Next Steps
Users should immediately uninstall the extension and revoke access for any suspicious connected applications in their Twitch security settings.
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service. [...]
Source: BleepingComputer ·