All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
A malicious Twitch browser extension with roughly 31,000 users — “Twitch Enhanced Viewer | JeetBot” — has been caught sending users' login information to a Russian commercial bot service, potentially allowing attackers to take control of their accounts.[1]
The stolen tokens act as account-level credentials, potentially allowing attackers to read and send chat messages and whispers, change account settings, and spend channel points without needing the user's password or two-factor authentication code.
If you're an active Twitch user, here's everything you need to know about the breach, what the exposed tokens could allow attackers to do, and the steps you should take to keep your account and personal information safe.
Socket found that “Twitch Enhanced Viewer | JeetBot” was secretly forwarding users' Twitch OAuth session tokens to servers controlled by a Russian commercial bot service. The extension was available on both the Chrome Web Store and Firefox Add-ons, with around 30,000 Chrome users and another 552 Firefox users at the time of the research.
The extension lured users in by offering appealing features such as blocking Twitch ads, unlocking region-restricted streams, automatically collecting channel points, and enabling higher-quality 1080p playback. These features provided genuine value, which likely helped convince users to install the extension in the first place.
To deliver the ad-free and region-unlocked video, the extension rerouted Twitch's video requests through its own proxy servers. In doing so, it captured the authorization token that Twitch's website uses to authenticate a logged-in user.
While redirecting the request through its proxies, the extension placed the token directly into the URL as an auth= parameter. Because the token was included in the URL rather than hidden inside the request body, it could be written in clear text into the proxy server's request logs, potentially allowing anyone with access to those logs to retrieve it.
Socket found that the extension was handling a full account-scoped Twitch OAuth token, which acts as a bearer credential. Anyone holding the token could potentially act on the account without knowing the user's password or passing a second-factor authentication check.
This could allow an attacker to:
That means a stolen token could give an attacker significant control over a victim's Twitch account, even if the victim has a strong password and 2FA enabled.
A compromised account could also be abused to impersonate the victim on Twitch. For example, an attacker could use their access to send phishing messages or whispers that appear to come directly from the legitimate account, potentially making it easier to trick friends, followers, or other users into clicking malicious links or sharing information.
None of this appears to be a simple case of the extension accidentally exposing a token. Socket found that earlier versions of the extension directly collected the tokens through dedicated endpoints.
In version 4.8, released in January 2026, the extension used a dedicated set of endpoints to POST captured tokens to the operator's servers, with backup collection endpoints hosted on Deno. The code also included a five-second cooldown between token submissions and silently ignored failed transmissions.
Later versions changed the mechanism. By May 2026, the dedicated collection endpoint had disappeared, but the token was still exposed as part of the extension's proxy-based ad-blocking and region-unlocking functionality. The current versions at the time of Socket's research continued forwarding the token through the proxy.
Also, the extension excluded 10 hardcoded Russian-language streamer channels from token forwarding. For virtually every other channel, the user's live token was sent to the proxy. Socket said the excluded channels were consistent with the operator's Russian-language audience.
Part of the responsibility here also rests with the platforms distributing the extension. Twitch Enhanced Viewer was available through both the Chrome Web Store and Firefox Add-ons.
The Chrome listing's data-safety disclosure reportedly said that the developer wouldn’t collect or use users' data, while its privacy policy claimed that the extension didn’t collect, store, or process user data. Socket's analysis found that the extension was doing exactly that by forwarding Twitch OAuth tokens to its proxy infrastructure.
This isn't an isolated problem with browser extension stores, either. A separate Socket investigation found 737 fake VPN and proxy extensions on the Chrome Web Store, with more than 75,000 combined installs. The extensions impersonated 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, and ExpressVPN. Google had removed 221 of them, but 516 remained active when Socket collected its data.
This is why you shouldn't assume that an extension is safe simply because you downloaded it from an official store. App and browser stores provide an important layer of protection, but they clearly can't catch every malicious extension before it reaches users.
If you've been using the malicious Twitch extension, here are the steps you should take to protect your account and personal information.
The Twitch incident is a good reminder that being available on an official browser extension store doesn’t automatically make an extension trustworthy. That means a lot of the responsibility for protecting your accounts ultimately falls on you.
Don't install an extension simply because it has a familiar name, a high user count, or an official-store listing. Check who developed it, what permissions it requests, what data it says it collects, and whether the developer has a credible reputation. Also consider using third-party protection tools such as VPNs, password managers, and identity theft protection services.
ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription
[1] Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
/images/2023/06/01/incogni-review.png)
/images/2023/05/02/phone-app-whatsapp.jpg)
/images/2026/09/15/twitch-extension-exposes-login-credentials.jpeg)
/images/2026/09/14/yet-another-meta-class-action.jpeg)
/images/2026/09/14/eus-plan-to-restrict-social-media.jpeg)
/images/2026/08/31/reset-act-markup-sept.jpeg)
/images/2026/08/28/metas-18b-settlement.jpeg)
/images/2026/07/21/france-social-media-ban.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/05/25/logo-aura.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)