A browser extension marketed as a better way to watch Twitch streams has been caught transmitting active OAuth tokens through infrastructure controlled by its operator. The add-on, named “Twitch Enhanced Viewer | JeetBot,” attracted about 30,000 users across Chrome and Firefox by promising features such as ad blocking, improved playback, region unlocking and automated reward collection.

Instead of limiting itself to those advertised functions, the extension handled live authentication material in a way that exposed user sessions. OAuth tokens can allow access without asking for the account password again, making their theft especially dangerous when users assume that multifactor authentication alone will protect them.

Convenience features concealed a serious risk

Browser extensions operate inside a highly trusted environment. Depending on their permissions, they can read page content, modify requests, observe browsing activity or interact with authenticated services. Users often approve those capabilities because an add-on needs some access to provide its stated features, but the same access can be abused.

In this case, the extension’s Twitch-focused functionality made interaction with account sessions appear normal. Researchers found that live tokens were sent through servers controlled by the operator. Routing sensitive authentication data through an unnecessary third party creates both an immediate interception risk and uncertainty about how the information may have been stored or used.

The scale—around 30,000 Chrome and Firefox users—means the incident is not confined to a handful of testers. Each exposed token represents a potentially active session, and affected users may also have linked payment methods, creator privileges or connected applications associated with their Twitch identities.

Why OAuth token theft can bypass expectations

Multifactor authentication is vital, but it primarily protects the login process. An attacker who obtains a valid session or OAuth token may not need to repeat that login. The precise access depends on the token’s scope and whether the service has revoked it, but defenders should treat an exposed token as a credential rather than harmless browser data.

For streamers and moderators, unauthorized account access can have consequences beyond personal viewing. Attackers may alter channel settings, misuse chat privileges, impersonate creators or target followers with scams. Ordinary viewers can also face privacy loss, fraudulent actions or abuse of connected services.

Steps affected users should take

• Remove the “Twitch Enhanced Viewer | JeetBot” extension from every browser profile where it was installed.
• Use Twitch security settings to revoke active sessions and disconnect unfamiliar or unnecessary authorized applications.
• Change the Twitch password, particularly if it was reused anywhere else, and keep multifactor authentication enabled.
• Review account email, security events, purchases, channel settings and linked applications for unauthorized changes.
• Update the browser and inspect other installed extensions for broad permissions or publishers that are no longer trusted.

Organizations should consider the risk as well. Employees may use consumer accounts in the same browser profiles that access corporate resources, while a malicious extension can sometimes observe more than the service it claims to enhance. Managed-browser policies can restrict extension installation, approve known publishers and provide an inventory for incident response.

A broader browser-extension security lesson

Store availability and high install counts are not proof that an extension is safe. Add-ons can change behavior through updates, rely on opaque remote services or request permissions whose impact is difficult for users to judge. Reviews and feature claims should therefore be weighed alongside publisher identity, update history, privacy practices and the minimum permissions required.

Users can reduce exposure by installing fewer extensions, separating sensitive work into a dedicated browser profile and removing add-ons that are no longer needed. Security teams can monitor extension identifiers and block known-bad software centrally where managed browsers are available.

The incident highlights a familiar security tradeoff: small convenience gains can carry disproportionate access. Once an extension can interact with authenticated sessions, it belongs in the same risk conversation as other software installed on the device. Prompt removal, token revocation and account review are the appropriate response for anyone who used this Twitch helper.