Socket: "JeetBot" Twitch Extension Steals 31,000 Users' OAuth Tokens

What it is

"Twitch Enhanced Viewer | JeetBot," a Chrome (ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox (twitchenhancedviewer@example.com, 552 users) extension analyzed by Socket. It markets ad-blocking, forced 1080p, region-unlock and channel-point auto-collection, and on the same requests forwards each viewer's live Twitch OAuth session token to proxy servers run by the JeetBot bot SaaS. The existing summary covers the capture-and-forward mechanism; what follows is the version boundary, the remediation ordering, and the IOCs it omits.

Preconditions / Affected

• Chrome build 85.8.4 (current at publication) still forwards the token. The fix (submitted, awaiting review) hardcodes auth to empty and strips auth-token parameters.
• Firefox 85.8.7 removes the forwarding — installs on older code keep forwarding until they update.
• Inline &auth= forwarding is present from v85.2.2 (May 20, 2026) through current builds; the version numbering jumped from 7.2.6 (April 25, 2026) to 85.2.2. Earlier v4.x builds (e.g. 4.8, Jan 8, 2026) POSTed tokens to /set-token endpoints (now decommissioned).

What to do

Order matters — removing the extension alone does not revoke a token already exfiltrated:

1. Firefox: update to 85.8.7 or later. Chrome: disable or remove the extension until the fixed build ships.
2. In Twitch settings, disconnect all sessions and re-authenticate to invalidate any forwarded token (a bearer token needs no password/2FA to abuse — chat, whispers, channel points, settings).
3. Security teams: block the IOC infrastructure at the network layer and inventory endpoints for both extension IDs.

Key IOCs (defanged):

• Proxies: enhanced[.]jeetbot[.]cc, proxy[.]morphilina[.]me, ext-03[.]jeetbot[.]cc
• Config API: ext-styles[.]jeetbot[.]cc/api/v1/proxies
• IPs: 152[.]53[.]177[.]186 (netcup, AS197540), 132[.]243[.]113[.]25 and 80[.]74[.]26[.]162 (CLODO, AS216154)
• Chrome SHA-256 e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8; Firefox SHA-256 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc
• MITRE: T1176, T1539, T1557, T1071.001

Caveats

• The token rides in the URL query string, so it lands in cleartext in the proxy's request logs regardless of transport encryption.
• The operator controls, server-side via the proxy catalog API, which host receives the token — blocking a single default host is insufficient.
• Ten hardcoded Russian streamer channels (pch3lk1n, flamie, dosia, etc.) are exempted from forwarding; every other channel forwards.
• The JeetBot team acknowledged the issue post-publication and shipped the Firefox fix; the "no data collection" claims in both store listings and the privacy policy (thebeholderbotapi[.]vercel[.]app/twitch-conf) remained contradicted by the live Chrome build.