NewsPublished 14 Sep 2026

Twitch extension with 30K installs exposes users’ OAuth tokens

Source Bleeping Computer

Description

A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service. [...]

Impact

Users who installed this extension risk having their Twitch OAuth tokens stolen, which could allow attackers to impersonate them on Twitch, perform actions on their behalf, or access private information. The compromise of OAuth tokens can lead to unauthorized account access and potential abuse of user privileges on the Twitch platform.

Defensive guidance

Users should immediately uninstall the Twitch Enhanced Viewer | JeetBot extension from their browsers. Additionally, affected users should revoke their Twitch OAuth tokens by logging into their Twitch account and resetting their authentication tokens or changing their passwords to invalidate existing tokens. Avoid installing browser extensions from untrusted sources and monitor Twitch account activity for suspicious behavior.

References

bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Sep 2026, 19:31 UTC

References

Community reviews