Loading story…
The Chrome and Firefox extension “Twitch Enhanced Viewer | JeetBot” exposed live Twitch OAuth bearer tokens from nearly 31,000 users by routing video-playlist requests through infrastructure controlled by the JeetBot bot service. Versions in the v85.x line appended tokens as an auth query parameter during redirects, while earlier v4.x releases reportedly sent captured tokens to set-token endpoints. Tokens in proxy URLs may be retained in request logs and can allow account actions without a password or second-factor challenge.
The extension’s token collection was not disclosed in its store privacy and data-safety statements, and it reportedly excluded a hard-coded list of ten predominantly Russian-language Twitch channels from forwarding. JeetBot says Firefox version 85.8.7 removes the proxy-token transmission behavior, but updating does not revoke credentials already exposed. Affected users should remove or update the extension and invalidate active Twitch sessions; security teams should identify its extension IDs and block known JeetBot proxy infrastructure.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
The Firefox add-on version history advanced to version 85.2.2, and inline forwarding of Twitch OAuth tokens in an auth URL parameter was present from this release through version 85.6.1.
The Firefox add-on's version history listed version 7.2.6 before its subsequent jump to the 85.x version series.
Version 4.8 of the extension POSTed captured Twitch OAuth tokens to a set-token endpoint on the selected proxy. Historical endpoints included enhanced[.]jeetbot[.]cc and Deno-hosted backup infrastructure.
The Firefox Add-ons listing for Twitch Enhanced Viewer | JeetBot, identifier twitchenhancedviewer@example.com, was published.
The Chrome Web Store listing for Twitch Enhanced Viewer | JeetBot, extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, was published.
The JeetBot website footer identified the operator as Popov Aleksandr Alekseevich, while HISHIMIRO was identified as the developer handle associated with the Chrome and Firefox extension listings. The report also identified associated JeetBot domains, proxy endpoints, and hosting IP addresses.
JeetBot documentation stated that Firefox add-on version 85.8.7 changed playlist retrieval so users' OAuth tokens would no longer be sent to JeetBot proxy servers. It advised users to update or disable older versions and warned that previously transmitted tokens would not be revoked; an equivalent Chrome update was reportedly under review.
Socket researchers reported that the Chrome and Firefox Twitch Enhanced Viewer | JeetBot extensions recovered account-scoped Twitch OAuth tokens and forwarded them through JeetBot-controlled proxy infrastructure for channels outside a hard-coded ten-channel allowlist. The extension had roughly 30,000 Chrome users and several hundred Firefox users at the time described.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceinfosecurity-magazine.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026
The Urban VPN Proxy Chrome extension, boasting over 6 million installs and a "Featured" badge on the Chrome Web Store, was discovered secretly collecting and exfiltrating user conversations with major AI chatbots, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Researchers found that a silent update in July 2025 (version 5.5.0) introduced hidden code that intercepts every prompt and response exchanged with these AI platforms, along with conversation identifiers, timestamps, and session metadata. The extension, which markets itself as a privacy and security tool, continued to harvest data regardless of whether the VPN service was active, betraying user trust and bypassing normal browser security boundaries. Captured data was sent to Urban VPN’s servers and subsequently sold to marketing analytics firms, notably BiScience, a known data broker. The malicious behavior was enabled by script injection that overrode browser APIs such as `fetch()` and `XMLHttpRequest()`, ensuring all relevant traffic was intercepted. The extension’s widespread distribution and high user ratings, combined with its presence on both Chrome and Edge marketplaces, amplified the impact of this breach. The incident highlights the risks posed by browser extensions with privileged access and the potential for abuse even among highly rated and officially endorsed add-ons.
Jun 29, 2026
Researchers reported that the **StealTok** campaign used at least 12 malicious browser extensions on the Chrome and Microsoft Edge stores that posed as TikTok video downloaders while covertly harvesting user data. The extensions shared a common Manifest V3 codebase and relied on attacker-controlled remote configuration, allowing operators to alter behavior after installation. More than **130,000 users** were affected over the life of the campaign, and roughly **12,500 installations** remained active at the time of reporting; some of the add-ons had even been labeled **"Featured"** in official marketplaces, helping them appear legitimate. The operation reportedly ran for more than a year and often kept extensions benign for **six to 12 months** before enabling information-stealing functions, a tactic that helped evade store review and build trust. Collected data included browsing and usage telemetry, TikTok content interaction, language and timezone settings, user-agent details, and battery status, giving attackers a strong fingerprint of victims’ environments. Researchers said the campaign appeared to be run by a single actor or tightly coordinated group using cloning, rebranding, and rapid redeployment to survive takedowns, and warned the same infrastructure could be expanded for broader data theft, session abuse, or proxy-style botnet activity.
Jun 29, 2026