15 SEP 2026 — A browser extension promising Twitch users an ad-free, high-definition stream was quietly forwarding their live login sessions to a Russian commercial bot service, according to research Socket published on 11 September. About 30,000 people had installed it from the Chrome Web Store and another 552 from Firefox's add-on store. When Infosecurity Magazine reported the finding, both listings were still live.
The extension delivered what it advertised, and that is why it spread.
What the extension offered
"Twitch Enhanced Viewer | JeetBot" promised four things viewers want: ad blocking, forced 1080p playback, streams unlocked in regions where they are restricted, and automatic collection of channel points, the loyalty currency viewers earn by watching.
Blocking Twitch ads and unlocking regions both work by routing the viewer's traffic through a proxy, and whoever runs a proxy can read whatever passes through it. The feature and the theft used the same pipe.
What it took
Socket's analysis found that the extension read the authorisation header from Twitch's own web client — the live OAuth token that proves to Twitch the browser belongs to a signed-in user — and passed it to its background process. From there it went to proxy servers on infrastructure run by JeetBot, which Socket describes as a Russian commercial bot service. Earlier versions posted captured tokens to dedicated collection endpoints; current builds attached them as a parameter on redirected requests, which leaves them sitting in the proxy's logs.
A token is not a password. It stands for a session that has already logged in, so whoever holds it can act as the account — reading and sending private whispers, posting in chat and spending channel points — without knowing the password or passing two-factor authentication.
Why a bot service wants real sessions
Viewer bots, chat bots and follower services exist because numbers on Twitch are a currency of their own. A channel that looks busy is recommended more, attracts more real viewers and earns more sponsorship. The difficulty for anyone selling that appearance is that Twitch works hard to detect fake accounts, and freshly created accounts with no history are the easiest thing for it to spot.
A real user's live session has history, a normal pattern of behaviour and a legitimate device behind it. Thirty thousand of them, delivered continuously by the users themselves, are the inventory a bot operation needs to make its activity look human. We are drawing that inference from the business JeetBot is described as running; Socket's report documents the collection, not what every token was used for.
The exclusion list
One detail in the code is unusual. Socket found ten Russian-language streamer channels hardcoded into the extension. For those channels, traffic was still routed through the proxies, but the viewer's token was not attached.
Socket describes this as deliberate, selective behaviour. Why an operator would carve out specific channels is not established by the research, and it would be speculation to say more than that. It does show that the forwarding was not an accident of a sloppy proxy. Somebody decided, channel by channel, whose sessions to take.
The store problem
Browser stores review extensions when they are submitted and when they update, but an extension that performs its advertised function while also shipping data elsewhere is harder to catch than one that does nothing useful. The permissions an ad-blocking proxy legitimately needs — to read and modify traffic on the site it blocks ads for — are the same permissions that let it read the session token. Nothing in the permission prompt distinguishes the two uses.
The limit is structural rather than one reviewer's lapse, and it explains why extension research like Socket's keeps turning up the same pattern: a useful tool with broad access to one site, and a second, undisclosed destination for what it sees there.
There are a few signs a user can check without reading code. An extension that promises to unlock regions or strip a site's own ads almost always does so by sending traffic through servers its developer controls, so the feature itself tells you a third party sits in the middle. The permission to read and change data on a specific site is the one to weigh most carefully, because it covers everything that site's pages hold, session details included. And an extension from a developer whose other products are bot or growth services deserves the question of why it wants to be installed by ordinary viewers.
What affected users should do
Remove the extension. Then, in Twitch's account settings, disconnect all active sessions and sign in again. Socket's advice is specific on this point, and it matters: uninstalling alone does not help, because the tokens already forwarded remain valid until the sessions they belong to are ended.
Changing the password is sensible but is not the fix on its own, since the stolen token never depended on it. The lesson applies well beyond Twitch. An extension that routes a site's traffic through its own servers is asking for complete trust in whoever runs those servers, whatever else it promises.
View author profile → · Editorial policy
