A browser add-on called “Twitch Enhanced Viewer | JeetBot” has been found leaking Twitch OAuth session tokens for nearly 31,000 users. The extension is available for both Google Chrome and Mozilla Firefox and routes tokens through proxy servers tied to a Russian commercial bot service.
How the Leak Works
The add-on claims useful features like region unlocking and ad-free viewing, but under the hood it forwards users’ OAuth tokens—embedded within URLs—to operator-controlled proxies for almost every Twitch channel watched. Only ten Russian-language streamer channels are explicitly excluded from this redirection. The tokens are exposed in plain text as they appear in the URL query string, allowing them to be stored in proxy server logs.
Earlier versions of the extension (e.g. from January 2026) went beyond forwarding via URLs and actually POSTed the tokens to a dedicated endpoint hosted by the operator, with backups on third-party services. This allowed full access to Twitch chat, whispers (private messaging), and certain account settings without needing a password or two-factor authentication.
Scale and Remediation
The Chrome Web Store listing has roughly 30,000 users; the Firefox version has about 604. The extension was published on June 26, 2025 for Chrome, and July 7, 2025 for Firefox. Users were given a warning when version 85.8.7 of the Firefox add-on addressed the token forwarding issue. The Chrome side is undergoing review for a similar update. Installations with older versions continue leaking tokens until updated.
Even if the extension is disabled or updated, tokens that have already been sent to the proxy aren’t revoked automatically. Users are advised to check their version and ensure it’s at least 85.8.7. If the updated version isn’t yet available, disabling the extension is recommended.
Operator and Developer Background
The extension is developed by “HISHIMIRO/jeetbot.cc” and is tied to a Cypriot developer named Aleksandr Popov. It advertises itself as a bot tool for Twitch, Kick, and VK Live, offering features such as speech synthesis, automatic translation, and other interaction tools. The developer claims over 26,000 active streamers use the service and it processes about one billion messages.
The token exposure was uncovered by Socket’s security researchers. They stress that OAuth tokens act like bearer credentials: anyone with them can act on behalf of the user—join chats, send messages, access private whispers—without needing a password or second factor.
As of now, the Firefox fix (version 85.8.7) is live, and a Chrome version is under review. Users should update immediately if possible, or disable the extension meanwhile.
Why this matters: OAuth tokens are meant to give limited access—say, viewing or commenting—but in the wrong hands, they unlock broader control. Because this exploit was built into a feature many users thought benign, it highlights how even trusted-seeming extensions can betray privacy at scale.
