JeetBot Malicious Browser Extension Campaign: Twitch OAuth Token Theft via Russian Proxy Infrastructure — OTX Detection Pack

A single high-fidelity OTX pulse published by AlienVault (TLP:WHITE, modified 2026-09-14) exposes a live credential-harvesting campaign operating under the name JeetBot, distributed as a browser extension titled "Twitch Enhanced Viewer | JeetBot" on both the Chrome Web Store and Firefox Add-ons marketplace. The extension accumulated approximately 30,000 Chrome installations and 552 Firefox installations before researchers identified its malicious functionality.

The attack chain is deceptively simple but strategically significant. The extension markets itself as a quality-of-life tool for Twitch viewers — ad blocking, stream unlocking — and actually delivers those features, which allowed it to pass marketplace review and sustain organic installs. In the background, however, it captures live Twitch OAuth session tokens from the victim's authenticated browser context and forwards them to attacker-controlled API endpoints hosted on the jeetbot.cc domain cluster, which resolve to Russian-controlled proxy infrastructure (notably 80.74.26.162).

The objective extends beyond simple account hijacking. The presence of /api/v1/forced-proxy and /api/v1/proxies endpoints indicates the extension can also convert victim browsers into residential proxy nodes, meaning infected users' bandwidth and IP reputation are monetized — likely for view-botting, ad fraud, or laundering other malicious traffic through legitimate residential IPs. Stolen OAuth tokens enable full account impersonation: stream key theft, chat manipulation, subscription fraud, and pivot attacks against linked accounts.

This is a supply-chain-style threat delivered through trusted storefronts, making traditional perimeter controls blind to it. Enterprise risk is real: employees using corporate-managed browsers with personal Twitch sessions, and any OAuth token theft pattern generalizes to more sensitive session types.

Threat Actor / Malware Profile: JeetBot

Attribution: The campaign is tracked as JeetBot, with infrastructure tied to Russian-controlled hosting. The operation shows hallmarks of a financially motivated cybercrime service rather than classic espionage APT, but the proxy-enrollment capability makes victim infrastructure reusable for downstream operations by other actors.

Distribution method: Legitimate browser extension marketplaces (Chrome Web Store, Firefox Add-ons). Social engineering is built into the value proposition — users willingly grant broad permissions (webRequest, cookies, tabs, storage) in exchange for ad-blocking and stream-unlocking features. Functional cover behavior is the primary evasion mechanism.

Payload behavior:

• Hooks into the browser's authenticated session state to capture live Twitch OAuth tokens.
• Exfiltrates tokens to http://enhanced.jeetbot.cc/set-token — a dedicated credential ingestion endpoint.
• Phones home to http://api.jeetbot.cc/api/v2/public/extension_helper/ for configuration and tasking, indicating a versioned, maintained C2 API (v2).
• Downloads proxy configuration from ext-styles.jeetbot.cc/api/v1/proxies and can be forced into proxy mode via /api/v1/forced-proxy, enrolling the victim browser as a traffic relay.

C2 communication: Plain HTTP (not HTTPS) to the jeetbot.cc domain cluster over standard ports — a detection gift. Versioned REST-style API paths (/api/v1/, /api/v2/) suggest an organized development operation. C2 resolves to 80.74.26.162 and 132.243.113.25.

Persistence mechanism: Browser extension installation itself — extensions auto-load at every browser launch, survive reboots, and sync across devices via Chrome/Firefox account sync. Removing local files does not remove the extension; enterprise extension policy or manual removal is required.

Anti-analysis techniques: Benign cover functionality that passes marketplace review and sandbox behavioral checks; logic likely gated behind C2-delivered configuration (the extension_helper endpoint) so static analysis of the extension package alone reveals limited malicious behavior. The two SHA256 hashes in the pulse represent analyzed extension package variants.

Relevant MITRE ATT&CK mapping: T1176 (Browser Extensions), T1539 (Steal Web Session Cookie), T1528 (Steal Application Access Token), T1071.001 (Application Layer Protocol: Web), T1090 (Proxy), T1102 (Web Service).

IOC Analysis

The pulse contains 27 indicators across four types:

Operationalization guidance for SOC teams:

• Domains first. The jeetbot.cc wildcard block (api., enhanced., ext-styles. subdomains) kills the entire kill chain — token exfiltration, C2 tasking, and proxy enrollment all traverse it. Plain HTTP means TLS inspection is not required to observe it in proxy logs.
• Extension inventory is the real detection surface. Pull managed-browser extension inventories (Chrome Enterprise, Edge for Business, Firefox policies, or EDR software inventory) and search for any extension with "JeetBot", "Twitch Enhanced Viewer", or unknown extensions with webRequest/cookies permissions.
• Tooling: Sigma rules below target network and extension behaviors. Chrome extension IDs can be enumerated from %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions and cross-referenced against the Web Store. Zeek/Suricata HTTP logs will surface the URI patterns /set-token, /forced-proxy, /proxies, and /extension_helper/.
• Retro-hunt window: Given ~30K installs and marketplace longevity, hunt proxy/DNS logs back at least 90 days, not just from pulse date.

Detection Engineering

---
title: JeetBot C2 Communication - Token Exfiltration and Proxy Enrollment
description: Detects network connections to known JeetBot malicious browser extension C2 infrastructure used for Twitch OAuth token theft and forced proxy enrollment
author: Security Arsenal Threat Intel
id: 8f3a1c2e-4b7d-4e9a-b1f6-jeetbot001c2
date: 2026/09/14
status: experimental
logsource:
    category: proxy
    product: zeek
level: high
tags:
    - attack.t1176
    - attack.t1539
    - attack.t1071.001
detection:
    selection_domain:
        - c-http-uri|contains: 'jeetbot.cc'
        - c-dns-query|contains: 'jeetbot.cc'
    selection_uri:
        c-http-uri|contains:
            - '/set-token'
            - '/forced-proxy'
            - '/api/v1/proxies'
            - '/api/v2/public/extension_helper'
    selection_ip:
        c-dst-ip:
            - '80.74.26.162'
            - '132.243.113.25'
    condition: selection_domain or selection_uri or selection_ip
falsepositives:
    - Threat researchers intentionally querying the infrastructure
---
title: Suspicious Browser Extension Installation - JeetBot OAuth Theft
description: Detects installation of the malicious Twitch Enhanced Viewer | JeetBot extension or suspicious extension directories referencing JeetBot artifacts in browser user profiles
author: Security Arsenal Threat Intel
id: 8f3a1c2e-4b7d-4e9a-b1f6-jeetbot002ext
date: 2026/09/14
status: experimental
logsource:
    category: file_event
    product: windows
level: high
tags:
    - attack.t1176
detection:
    selection_chrome:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\'
            - '\Microsoft\Edge\User Data\'
        TargetFilename|endswith: '\manifest.json'
    selection_firefox:
        TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
        TargetFilename|endswith:
            - '.xpi'
            - '\extensions.json'
    filter_known:
        Image|startswith: 'C:\Program Files'
    condition: (selection_chrome or selection_firefox) and not filter_known
falsepositives:
    - Legitimate extension installs by users and developers
---
title: OAuth Token Exfiltration Pattern Over Plain HTTP
description: Detects HTTP POST requests carrying token-like parameters to non-standard endpoints, consistent with JeetBot set-token exfiltration behavior
author: Security Arsenal Threat Intel
id: 8f3a1c2e-4b7d-4e9a-b1f6-jeetbot003http
date: 2026/09/14
status: experimental
logsource:
    category: proxy
level: medium
tags:
    - attack.t1528
    - attack.t1567
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains:
            - 'token='
            - 'oauth'
            - 'access_token'
    filter_twitch_legit:
        c-uri|contains:
            - 'twitch.tv'
            - 'id.twitch.tv'
            - 'gql.twitch.tv'
    condition: selection and not filter_twitch_legit
falsepositives:
    - Legitimate OAuth flows to sanctioned identity providers - maintain an allowlist

// JeetBot OAuth Token Theft Hunt - Microsoft Sentinel
// Hunts network connections to JeetBot C2/proxy infrastructure and suspicious token exfiltration URIs
let jeetbot_ips = dynamic(["80.74.26.162", "132.243.113.25"]);
let jeetbot_domains = dynamic(["jeetbot.cc", "api.jeetbot.cc", "enhanced.jeetbot.cc", "ext-styles.jeetbot.cc"]);
let suspicious_uris = dynamic(["/set-token", "/forced-proxy", "/api/v1/proxies", "/api/v2/public/extension_helper"]);
union
(DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (jeetbot_ips) or RemoteUrl has_any (jeetbot_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (suspicious_uris)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
| sort by Connections desc

# JeetBot Malicious Extension Hunt - Enterprise Sweep
# Checks browser extension stores, running processes, and active connections for JeetBot artifacts

$jeetbotHashes = @(
    "141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc",
    "e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8"
)
$jeetbotIPs = @("80.74.26.162", "132.243.113.25")
$jeetbotKeywords = @("jeetbot", "Twitch Enhanced Viewer")

Write-Host "=== [1] Chrome/Edge Extension Inventory ===" -ForegroundColor Cyan
$browserProfiles = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
)
foreach ($profile in $browserProfiles) {
    if (Test-Path $profile) {
        Get-ChildItem -Path $profile -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue |
            ForEach-Object {
                $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                foreach ($kw in $jeetbotKeywords) {
                    if ($content -match $kw) {
                        Write-Host "[!] MALICIOUS EXTENSION FOUND: $($_.FullName)" -ForegroundColor Red
                    }
                }
            }
    }
}

Write-Host "=== [2] Firefox Extension Check ===" -ForegroundColor Cyan
Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Recurse -Include "extensions.json","*.xpi" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
        foreach ($kw in $jeetbotKeywords) {
            if ($content -match $kw) {
                Write-Host "[!] MALICIOUS FIREFOX EXTENSION: $($_.FullName)" -ForegroundColor Red
            }
        }
    }

Write-Host "=== [3] Active Connections to JeetBot C2 ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $jeetbotIPs -contains $_.RemoteAddress } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] ACTIVE C2 CONNECTION: $($_.RemoteAddress):$($_.RemotePort) <- $($proc.ProcessName) (PID $($_.OwningProcess))" -ForegroundColor Red
    }

Write-Host "=== [4] DNS Cache Check ===" -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $_.Entry -match "jeetbot" } |
    ForEach-Object { Write-Host "[!] DNS CACHE HIT: $($_.Entry) -> $($_.Data)" -ForegroundColor Red }

Write-Host "=== [5] Hash Sweep of Downloaded Extension Packages ===" -ForegroundColor Cyan
Get-ChildItem "$env:LOCALAPPDATA","$env:APPDATA" -Recurse -Include "*.crx","*.xpi" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash.ToLower()
        if ($jeetbotHashes -contains $h) {
            Write-Host "[!] KNOWN MALICIOUS PACKAGE HASH: $($_.FullName) [$h]" -ForegroundColor Red
        }
    }

Write-Host "=== Hunt Complete ===" -ForegroundColor Green

Response Priorities

Immediate (0-4 hours):

• Block the full jeetbot.cc domain cluster and IPs 80.74.26.162 / 132.243.113.25 at egress firewall, secure web gateway, and DNS. Block categorically — all subdomains.
• Push the two SHA256 hashes to EDR blocklists.
• Run the PowerShell hunt script and Sentinel KQL across the fleet; flag any host with JeetBot extension artifacts or C2 connections for isolation.
• Force-removal: use Chrome/Edge enterprise policy (ExtensionInstallBlocklist / ExtensionSettings) and Firefox enterprise policy to blocklist and remove the extension across managed browsers.

24 hours:

• Identity verification is mandatory — this is credential-theft malware. Any user whose device shows JeetBot indicators must have their Twitch OAuth tokens revoked (Twitch Settings → Connections → disconnect all sessions; reset password) and all active sessions invalidated.
• Review whether corporate SSO sessions on the same browser profiles could have been exposed; the extension's permission model (webRequest, cookies) is generic enough to capture other session tokens. Treat managed-browser compromise as potential broader session theft.
• Retro-hunt proxy/DNS/NetFlow logs 90 days back for the URI patterns /set-token, /forced-proxy, /proxies, /extension_helper to identify historical victims whose tokens may already be abused.

1 week:

• Deploy an extension allowlisting policy across all managed browsers — default-deny with an approved catalog. This is the only durable control against marketplace-delivered malicious extensions.
• Implement detection for the broader behavior class: browser processes initiating HTTP POSTs with token-like parameters to unsanctioned domains (Sigma rule 3 above).
• Audit existing installed extensions fleet-wide for excessive permissions (broad webRequest + cookies + host access is the dangerous combination).
• Update user awareness guidance: functional cover behavior does not equal legitimacy; marketplace presence does not equal vetting.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub