Anyone who has installed a specific Twitch browser extension should act now. Security researchers have discovered an extension that forwards credentials in plain text to a commercial bot service.
Which Twitch Extension Is Affected and What Does It Do?
The affected extension is “Twitch Enhanced Viewer,” also known as “JeetBot,” which could be installed normally through the official Chrome and Firefox stores – with approximately 30,000 Chrome users and an additional 552 Firefox users. The extension redirected video requests through a proxy server belonging to a Russian-speaking commercial bot service. The actual problem: users’ OAuth session tokens ended up in plain text within the proxy logs. Anyone with access to these logs could theoretically access chat, whispers, and account settings – completely without a password or two-factor code.
How to Protect Your Twitch Account Right Now?
Simply uninstalling the extension is not enough, according to the developers of the security analysis, as already extracted tokens may remain valid. Affected users should therefore:
- Immediately remove the “Twitch Enhanced Viewer”/JeetBot extension from your browser
- In Twitch account settings, under “Security and Privacy,” manually revoke all active sessions
- To be safe, change your password and, if not yet active, set up two-factor authentication
- Generally review which third-party apps and extensions have access to your account
Why Are Browser Extensions for Streaming Accounts So Risky?
This case highlights a fundamental problem: an official store listing on Chrome or Firefox is not a security seal of approval. Extensions with OAuth access to streaming or social media accounts have been a popular target for years because they often receive extensive permissions, but hardly anyone actually reviews their code. For the Twitch community, this current incident primarily means: for every extension that promises “more features” for chat or viewership, it’s worth taking a critical look at the developer and permissions before installing it.
Source: BleepingComputer, The Hacker News
Do you use third-party Twitch extensions? It’s best to check your installed extensions immediately and let us know if you were affected!
Comments (0)
No comments yet — be the first to share your take.