Malicious "Twitch Enhanced Viewer" Extension Leaks OAuth Tokens From 31,000 Users — Detection, Token Revocation, and Browser Hardening Guide

Nearly 31,000 Twitch users have had their OAuth access tokens silently siphoned to proxy infrastructure operated by a Russian commercial bot service, after installing a browser extension called "Twitch Enhanced Viewer | JeetBot". The extension was distributed through both the Google Chrome Web Store and the Mozilla Firefox Add-Ons store — meaning this is not a sideloading story. It came through the "trusted" official storefronts, listed under the developer identity HISHIMIRO / jeetbot.cc.

This is not a nuisance adware incident. An OAuth access token for Twitch is a bearer credential: whoever holds it can act as the user — read and send chat messages, follow/unfollow channels, manage channel points, access subscriber data, and in many configurations trigger moderation actions — without the user's password and without tripping MFA. That is precisely what a commercial viewbot/chatbot service wants: a large pool of legitimate, aged, real-user identities to rent out for artificial engagement, spam, and fraud.

If your organization has employees streaming, moderating brand channels, or simply browsing Twitch on corporate endpoints, this extension may be sitting in a browser profile right now with a valid, unexpired token already exfiltrated. Treat it as a credential compromise, not an unwanted-software ticket.

Technical Analysis

Affected Platforms

• Google Chrome (Chrome Web Store listing)
• Mozilla Firefox (Firefox Add-Ons listing)
• Chromium-derived browsers (Edge/Brave/Opera users installing from the Chrome Web Store are also in scope)

The extension was listed as "Twitch Enhanced Viewer | JeetBot", developer attribution HISHIMIRO, with backend infrastructure at jeetbot.cc and associated proxy servers.

How the Attack Works (Defender's View)

Browser extensions occupy a uniquely privileged position. Once installed, a content-script-capable extension with host permissions for twitch.tv can:

1. Request or harvest OAuth tokens. Extensions that legitimately integrate with Twitch commonly implement the OAuth implicit/authorization-code flow against id.twitch.tv. A malicious extension can simply persist the returned access_token, or scrape tokens from localStorage/cookies on twitch.tv pages it has host access to.
2. Exfiltrate via background service workers. Manifest V3 service workers (Chrome) and background scripts (Firefox) can make arbitrary fetch() calls to attacker infrastructure — in this case proxy servers tied to the jeetbot.cc bot service. From a network telemetry standpoint, the traffic appears to originate from the browser process itself, which defeats naive per-process allowlisting.
3. Blend exfiltration into legitimate API chatter. Because the extension is Twitch-themed and expected to talk to Twitch endpoints, defenders who only baseline "does the browser talk to Twitch?" will see nothing anomalous. The signal is the third-party destination — jeetbot.cc and its proxy fleet — riding alongside legitimate api.twitch.tv / id.twitch.tv / gql.twitch.tv traffic.
4. Token reuse off-host. Once exfiltrated, tokens are replayed from the bot service's proxy infrastructure. This is the detection opportunity most organizations miss: Twitch OAuth usage from IP addresses and ASN space that has no relationship to the user's actual geography or browsing session.

Exploitation Status

This is confirmed, active, in-the-wild abuse — not a theoretical risk. Roughly 31,000 users are confirmed impacted, and exfiltration to the bot service's proxy servers was observed operationally. At the time of writing there is no CVE assigned (malicious extensions are policy/ abuse incidents, not memory-corruption bugs), and no CISA KEV entry — do not wait for either before acting. The "vulnerability" here is the trust model of the extension stores combined with over-broad OAuth consent.

Why Store Presence Matters

Both Google and Mozilla operate automated and human review for their stores, and both have been repeatedly bypassed by extensions that ship clean and activate malicious logic later (time-delayed payload, server-side feature flags, or post-install updates). This extension passing review means your "we only allow store installs" control is necessary but not sufficient.

Detection & Response

The observables worth hunting are: (a) the extension's presence in browser profiles, (b) browser-originated connections to jeetbot.cc infrastructure, and (c) off-host reuse of Twitch OAuth tokens. Hunt all three — extension removal alone does not invalidate already-stolen tokens.

SIGMA Rules

---
title: DNS Query to JeetBot Twitch Extension C2 Domain
id: 3f7c2a91-8b4d-4e16-9a52-1c8d7e5f6a01
status: experimental
description: Detects DNS resolution of jeetbot.cc, the backend domain of the malicious "Twitch Enhanced Viewer | JeetBot" extension that exfiltrated Twitch OAuth tokens from ~31,000 users.
references:
  - https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'jeetbot.cc'
  condition: selection
falsepositives:
  - Threat researcher or IR analyst investigation of the domain
level: high
---
title: Browser Process Network Connection to JeetBot Exfiltration Domain
id: 9e1b4d72-6c3a-4f58-b7d9-2e4a8c1f5b02
status: experimental
description: Detects Chrome, Firefox, Edge, Brave, or Opera processes establishing network connections to jeetbot.cc infrastructure, consistent with OAuth token exfiltration by the malicious Twitch Enhanced Viewer extension. Traffic from a browser process to non-Twitch, non-CDN infrastructure associated with a Twitch extension is a strong signal.
references:
  - https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html
  - https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1539
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_domain:
    DestinationHostname|contains:
      - 'jeetbot.cc'
  condition: selection_img and selection_domain
falsepositives:
  - None expected in production environments; the domain is exclusively associated with the bot service
level: critical
---
title: Creation of Browser Extension Files in User Profile Extension Directories
id: 5a8c3e14-2d7b-4a91-c6f3-8b1e9d4a7c03
status: experimental
description: Detects creation of manifest.json and content/background script files inside Chrome, Edge, or Firefox extension directories shortly after install. Intended as a hunt pivot to enumerate recently added extensions for review against the Twitch Enhanced Viewer / JeetBot indicator. Expect volume; scope to recent timeframes and investigate extension names/publishers.
references:
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_chrome:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Local\BraveSoftware\'
    TargetFilename|endswith:
      - '\manifest.json'
      - '\background.js'
      - '\service_worker.js'
      - '\content.js'
  selection_path_marker:
    TargetFilename|contains: '\Extensions\'
  condition: selection_chrome and selection_path_marker
falsepositives:
  - Legitimate extension installs and updates (high volume) — use as a hunt query, not an always-on alert; correlate install time with user reports of Twitch tool installation
level: low

KQL — Microsoft Sentinel / Defender

This query hunts both sides of the problem: browser processes talking to jeetbot infrastructure, and extension artifacts landing in user profiles. Run the file portion over at least 90 days — extensions installed months ago may only have been activated recently.

let lookback = 90d;
let maliciousDomain = dynamic(["jeetbot.cc"]);
// Part 1: Browser processes connecting to JeetBot exfiltration infrastructure
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe", "brave.exe", "opera.exe")
| where RemoteUrl has_any (maliciousDomain) or RemoteIP in (
    toscalar(DeviceNetworkEvents
        | where Timestamp > ago(lookback)
        | where RemoteUrl has_any (maliciousDomain)
        | distinct RemoteIP))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend Hunt = "Network-Exfil";
// Part 2: Extension manifest files created in browser profile extension directories
DeviceFileEvents
| where Timestamp > ago(lookback)
| where FolderPath has_any (@"\Google\Chrome\User Data\", @"\Microsoft\Edge\User Data\", @"\BraveSoftware\", @"\Mozilla\Firefox\Profiles\")
| where FolderPath has @"\Extensions\" or FolderPath has @"\extensions\"
| where FileName in~ ("manifest.json", "background.js", "service_worker.js", "content.js")
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessAccountName
| extend Hunt = "Extension-Install"
| order by Timestamp desc

For the third leg — off-host token reuse — if you ingest Twitch-facing proxy, ZTNA, or CASB logs (or work with Twitch's security team via abuse reporting), hunt OAuth-bearing requests where the source ASN/geography is inconsistent with the user's normal access profile. Commercial bot proxies typically operate out of hosting-provider ASN space rather than residential ISP space. That delta is your signal.

Velociraptor VQL

This artifact enumerates installed extension directories across all user profiles on an endpoint and pulls the extension display name from each manifest, letting you hunt at scale for "Twitch Enhanced Viewer", "JeetBot", or publisher references — far more reliable than guessing extension IDs, which differ between stores and reinstalls.

-- Enumerate browser extensions across user profiles and flag JeetBot/Twitch Enhanced Viewer indicators
LET manifest_glob = '''C:/Users/*/AppData/Local/*/User Data/*/Extensions/*/*/manifest.json'''

LET manifests = SELECT FullPath,
       read_file(filename=FullPath, length=200000) AS ManifestContent
FROM glob(globs=manifest_glob)

SELECT FullPath,
       ManifestContent,
       if(condition=ManifestContent =~ '(?i)(jeetbot|twitch enhanced viewer|hishimiro)',
          then='MATCH', else='clean') AS Verdict
FROM manifests
WHERE Verdict = 'MATCH'

-- Corroborate with live network connections from browser processes to suspicious destinations
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(chrome|firefox|msedge|brave|opera)'
  AND Status = 'ESTABLISHED'

Run the extension-enumeration portion as a fleet-wide hunt. Any MATCH verdict is an incident: the token is already gone, and your response clock started weeks ago.

Remediation Script

The script below enumerates Chrome, Edge, Brave, and Firefox extension stores across all local user profiles, flags the malicious extension by name/publisher, exports findings for evidence preservation, and (with -Remove) deletes the flagged extension directories. It also outputs the exact token-revocation URL for the help desk to send to impacted users — because deleting files does not revoke OAuth grants.

#Requires -RunAsAdministrator
# Security Arsenal - JeetBot Twitch Extension Detection & Removal
param([switch]$Remove)

$Indicators = '(?i)(jeetbot|twitch enhanced viewer|hishimiro)'
$ReportPath = "C:\ProgramData\SecurityArsenal\JeetBot_Extension_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
New-Item -ItemType Directory -Path (Split-Path $ReportPath) -Force | Out-Null
$Findings = @()

# Chromium-based browsers: parse every manifest.json under profile Extensions dirs
$ChromiumRoots = @(
    "$env:SystemDrive\Users\*\AppData\Local\Google\Chrome\User Data",
    "$env:SystemDrive\Users\*\AppData\Local\Microsoft\Edge\User Data",
    "$env:SystemDrive\Users\*\AppData\Local\BraveSoftware\Brave-Browser\User Data"
)
foreach ($root in $ChromiumRoots) {
    Get-ChildItem -Path $root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
        Get-ChildItem -Path "$($_.FullName)\*\Extensions\*\*\manifest.json" -ErrorAction SilentlyContinue | ForEach-Object {
            $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match $Indicators) {
                $extDir = Split-Path (Split-Path $_.FullName)
                $Findings += [pscustomobject]@{
                    Browser   = ($root -split '\\')[-1]
                    Manifest  = $_.FullName
                    Extension = $extDir
                    Removed   = $false
                }
                if ($Remove) {
                    Remove-Item -Path $extDir -Recurse -Force -ErrorAction SilentlyContinue
                    $Findings[-1].Removed = -not (Test-Path $extDir)
                }
            }
        }
    }
}

# Firefox: scan extensions.json in each profile for name/developer matches
Get-ChildItem "$env:SystemDrive\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\extensions.json" -ErrorAction SilentlyContinue | ForEach-Object {
    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    if ($content -match $Indicators) {
        $Findings += [pscustomobject]@{
            Browser   = 'Firefox'
            Manifest  = $_.FullName
            Extension = "Profile: $(Split-Path $_.FullName) - remove via about:addons or delete profile extensions dir"
            Removed   = $false
        }
    }
}

$Findings | Export-Csv -Path $ReportPath -NoTypeInformation
if ($Findings) {
    Write-Host "[ALERT] $($Findings.Count) malicious extension artifact(s) found. Report: $ReportPath" -ForegroundColor Red
    Write-Host "[ACTION REQUIRED] Deletion does NOT revoke stolen OAuth tokens. Direct each affected user to:" -ForegroundColor Yellow
    Write-Host "  https://www.twitch.tv/settings/connections  -> Disconnect 'Twitch Enhanced Viewer | JeetBot' and any unrecognized apps" -ForegroundColor Yellow
} else {
    Write-Host "[OK] No JeetBot/Twitch Enhanced Viewer indicators found." -ForegroundColor Green
}

Remediation

Work this in order. Skipping step 2 leaves valid bearer tokens in attacker hands even after cleanup.

1. Remove the extension everywhere. Use the script above (or your EDR's software inventory) to locate and remove "Twitch Enhanced Viewer | JeetBot" across Chrome, Edge, Brave, and Firefox profiles. Confirm removal in the Firefox case manually via about:addons — Firefox profile cleanup is less deterministic from the filesystem.
2. Revoke OAuth grants immediately. Every affected user must visit https://www.twitch.tv/settings/connections and disconnect the JeetBot application and any application they do not recognize. Revocation server-side is the only reliable kill for a stolen token. Follow with a password reset and enforce 2FA — password change alone does not invalidate already-issued OAuth tokens, so revocation must come first.
3. Hunt for off-host token replay. Review 90+ days of IdP, proxy, and CASB telemetry for Twitch OAuth activity from hosting-provider ASNs or geographies inconsistent with each user. Report confirmed abuse to Twitch's security/abuse channels so platform-side invalidation can be applied at scale.
4. Block the infrastructure. Add jeetbot.cc (and the proxy IPs observed in your telemetry) to DNS sinkhole, web proxy, and EDR network-block lists. Retain, don't just block — you want future resolution attempts logged as re-infection signals.
5. Prevent recurrence with enterprise extension policy. This is the durable fix. Deploy Chrome/Edge ExtensionInstallAllowlist (with ExtensionInstallBlocklist set to *) via Group Policy or Intune so only vetted extensions can install; apply the equivalent Firefox policy via policies.json (ExtensionSettings with an allowlist and installation_mode: "blocked" as default). An allowlist-by-default posture is the single control that would have prevented this incident class entirely.
6. Institutionalize extension review. Add new-extension-install file events (the Sigma hunt rule above) to your detection backlog review cadence, and require security review for any extension requesting host permissions on domains tied to corporate identity (Twitch brand channels, Google Workspace, Microsoft 365).

There is no vendor patch to apply here — the remediation is removal, token revocation, and extension governance. Treat any endpoint where the extension was present as a confirmed credential exposure in your IR tracking, with the same rigor you'd apply to a phished password.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub