Malicious Twitch browser extension leaks OAuth tokens for nearly 31,000 users

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service, according to a recent report by The Hacker News.

The extension, named "Twitch Enhanced Viewer | JeetBot," was available on both the Google Chrome Web Store and Mozilla Firefox Add-Ons store, with approximately 30,000 users on Chrome and 604 on Firefox. The extension claims to offer features like 1080p streaming for restricted regions and an ad-free experience. However, it functions by routing user requests through operator-controlled proxy servers, embedding the user's OAuth token as a query parameter in the URL. This token grants access to a user's chat, private messages, and account settings.

The redirection mechanism excludes a hardcoded list of 10 Twitch channels, primarily Russian streamers. While the developer has released updated versions of the extension to address the vulnerability, older versions continue to transmit tokens until updated. The developer has warned that disabling or updating the extension does not revoke previously transmitted tokens.

Source: The Hacker News