A browser extension shipped 30,000 OAuth tokens to a proxy

Your staff are logged into your Shopify admin, your Stripe dashboard, and your Google Ads account in the same browser profile where they installed a free extension last year. That is the whole story here. Socket's threat research team found that "Twitch Enhanced Viewer | JeetBot" — live in the official Chrome and Firefox stores — forwards users' Twitch OAuth session tokens to servers run by a commercial bot service. BleepingComputer picked it up on September 15.

What actually happened

The extension advertises exactly the things people want: ad blocking, forced 1080p, region unlocks, channel-point collection. It delivers those. It also reads the Authorization header out of Twitch's own web client and takes the OAuth token.

Current builds (the 85.x line) append the token as an &auth= query parameter on a network-layer redirect that routes playlist requests through proxies the operator controls. Earlier 4.x builds were blunter — a direct POST to a set-token endpoint. Socket reports the tokens land in cleartext logs on those proxies. Installs: roughly 30,000 on Chrome, 552 on Firefox.

The detail that removes any doubt about intent: token forwarding is skipped for a hardcoded allowlist of ten Russian streamer channels. Everyone else's session goes to the proxy. Socket attributes the infrastructure to JeetBot, a Russian-language commercial streaming and chatbot service.

A Twitch OAuth token is not a password, and that is worse, not better. It is a bearer credential — whoever holds it is the user until it expires or the session is revoked. Changing your password does nothing. JeetBot's own documentation says version 85.8.7 stops sending the token; that is the vendor's claim about its own product, and at the time of Socket's writing both store listings were still live.

Why this matters for your business

Extension permissions are your real blast radius. An extension granted host access to a site reads what your browser reads on that site — including the session cookies and headers that authenticate your admin panels. The threat model is not "will this extension leak my Twitch account." It is "what else does this profile have open."

The distribution channel was legitimate. Chrome Web Store. Firefox Add-ons. Signed, reviewed, thousands of installs, working features, a real company behind it. Store presence is not a security control, and neither is install count — 30,000 people installed this one.

Separate the browser profile that touches money. The cheapest fix in this entire post: a dedicated browser profile, or a dedicated browser, for Shopify admin, payment dashboards, ad accounts, and your registrar. Zero extensions in it. No cost, no vendor, ten minutes.

Revocation, not password rotation, is the recovery step. If someone on your team ran this, uninstalling is half the job — every forwarded token stays valid until the session is killed. Sign out of all sessions on the affected service. Then go apply the same reflex to your own stack: know where "revoke all sessions" lives in Shopify, Google Workspace, and Stripe before you need it.

Sources: Socket, BleepingComputer.