Researchers Say Twitch Extension JeeBot Sent 31,000 Users' OAuth Tokens to Russian Proxies

On the Chrome Web Store, the extension was advertised as a modern tool for streamers and viewers who value quality, convenience, and control. TechRadar reported that it promised clearer streaming and viewing, 2K content viewing, hiding banner ads and unwanted elements, and an AI bot to make it easier to interact with a stream.

Socket said the extension was designed to retrieve Twitch video stream playlists through its own proxy servers. Instead of simply forwarding the requests, it attached users' OAuth tokens; because the tokens were placed in the URL, they also ended up in the proxy server's request logs.

According to Socket, current builds v85.x forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy. The token is forwarded for every channel a user watches except for a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding. TechRadar reported that the developer HISHIMIRO/jeetbot.cc released version 85.8.7 for Firefox, while the Chrome version is under review. The update fixes the flaw: when playlists are retrieved, the user's OAuth token is no longer sent to the proxies.

TechRadar said the incident could look like an honest mistake remedied after responsible disclosure, but it noted that the hardcoded exemptions for ten Russian streamer channels suggest deliberate design. The report said whether the activity was malicious is not easily determined. Users who installed the extension should revoke their exposed Twitch tokens to be safe, according to the report.