Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service
Source AlienVault OTX General
0
Description
A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' distributed via Chrome Web Store and Firefox Add-ons steals Twitch OAuth tokens from approximately 30,000 Chrome users and 552 Firefox users. The extension masquerades as a tool to improve user experience by blocking ads and unlocking streams but secretly captures and exfiltrates OAuth session tokens to Russian-controlled proxy servers. The stolen tokens are sent during video playlist redirects or via POST requests to collection endpoints. The operator is linked to a commercial Russian bot service called JeetBot, with infrastructure hosted in Germany and cloud providers.
Indicators of compromise
Domains 12
- alexue4.dev
- morphilina.me
- jeetbot.cc
- api.jeetbot.cc
- enhanced-1.jeetbot.cc
- enhanced.jeetbot.cc
- ext-03.jeetbot.cc
- ext-styles.jeetbot.cc
- img.drisnya.online
- proxy.morphilina.me
URLs 11
- http://api.jeetbot.cc/api/v2/public/extension_helper/
- http://enhanced.jeetbot.cc/set-token
- http://ext-styles.jeetbot.cc/api/v1/forced-proxy
- http://ext-styles.jeetbot.cc/api/v1/proxies
- http://proxy.thebeholder.deno.net/set-token
- http://thebeholder-proxy.deno.dev/set-token
- https://enhanced.jeetbot.cc/
- https://ext-styles.jeetbot.cc/api/v1/proxies
- https://proxy.morphilina.me/
- https://proxy.thebeholder.deno.net/
IP addresses 2
- 132.243.113.25
- 80.74.26.162
Hashes 2
Community reviews
Loading reviews…