Here is a rule of thumb: if a browser extension offers you free 1080p and no ads on a platform that sells 1080p and ads for a living, it wants something back. This time, the something was your account.
Security researchers at Socket found that a Twitch extension called Twitch Enhanced Viewer, sold under the JeetBot brand, had been quietly forwarding the OAuth session tokens of close to 31,000 people to proxy servers run by a Russian bot company. It was sitting on both the Chrome and Firefox stores, and when the story went out, both listings were still up and installable. The Hacker News has the full write-up.
The pitch was the usual: ad-free Twitch, 1080p in regions that normally get throttled. To pull that off, the extension routed Twitch’s video requests through the operator’s servers and stapled each viewer’s OAuth token onto the URL as an &auth= parameter. Subtle.
The detail that gives away the intent is almost petty. The token got forwarded for every channel you watched, except a hardcoded list of ten mostly Russian-language streamers, whose sessions were politely left alone. Someone sat down and wrote that allowlist by hand. On purpose.
Here is why it matters beyond the gaming corner of the internet. A Twitch session token is a bearer credential, which is a fancy way of saying it is a hall pass. Whoever holds it gets to be you, with no password and no second factor: reading your private whispers, posting in your name, poking around your account settings. And because the token was riding along inside the URL, it got written into the proxy’s logs in plain text, where it lingers long after you close the tab.
The operator has since pushed a version that stops sending the token, which is genuinely the right call. It also does precisely nothing for the tokens that already left. Those stay valid until someone actively revokes them, and this is the trap: deleting the extension feels like fixing it, and it revokes nothing. You can uninstall, feel virtuous, and still be handing out a working key you no longer control.
On the surface this is a Twitch story. Underneath, it is a nudge about two things most of us are quietly bad at. Browser extensions run with sweeping permissions inside the very same session where we are logged into our email, our bank, and our work tools, and almost nobody audits the pile they installed in 2022 and forgot about. And OAuth tokens get filed away in our heads as boring plumbing, when they are closer to spare keys we have handed to apps we no longer remember using.
So, the practical bit. If you look after other people’s machines, this is a good week to find out which extensions are actually installed across your fleet and what they are allowed to touch, and to make sure you can revoke OAuth sessions in a hurry when one goes bad. If you are just here to watch people play video games, check whether you have this extension, update or remove it, and then go into Twitch’s settings and revoke your active sessions.
One line to keep: a leaked token stays alive until you revoke the session yourself. Deleting the extension does nothing to it, so the real last step, the one everyone skips, is to go kill your active sessions in Twitch’s settings.
