Twitch Extension Exposes OAuth Tokens of 30,000 Chrome Users

| 2026-09-14 13:56 LOW MEDIUM DATA BREACH

JSON

Executive Summary

Highlight CTI
AI-generated

On September 14, 2026, a malicious Twitch extension exposed OAuth tokens of approximately 30,000 Chrome and Firefox users. The attack was attributed to the "jeetbot" extension, which had been compromised by an attacker exposing sensitive user data through its API endpoints at [IOC HIDDEN • LOGIN REQUIRED]. The affected users' OAuth tokens were accessible via various proxy servers linked to [IOC HIDDEN • LOGIN REQUIRED] and [IOC HIDDEN • LOGIN REQUIRED], including a proxy server hosted on deno.net. The malicious extension was also found to be using enhanced-1, enhanced, ext-03, ext-styles, img, and thebeholder-proxy domains. As of now, no further updates have been reported regarding this incident or its resolution.

Technical Mitigations AI-generated

• Block or hunt for the <a href="/auth/login?next=/detail/WToXPqEBDYL3N98k8gDc" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN • LOGIN REQUIRED]</span></a> and proxy[.]thebeholder domains to prevent potential phishing attacks. • Patch Chrome and Firefox versions prior to 2022-04-01 (affected by OAuth token exposure) using the latest available updates. • Detect Jeetbot's presence in browser extensions by monitoring for the 'enhanced-1' or 'ext-03' identifiers.

Technical Observables Login Required

Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

urls (1)


                                                    hxxp://••••••••••••••••••••

sha256 (2)


                                                    141c35••••••••••••••••••••••••••••••••••••••••••••••••••••••••••


                                                    e17e1e••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

domains (14)


                                                    th•••••.dev


                                                    je•••••.cc


                                                    pr•••••.net


                                                    th•••••.app

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

Target & Sectors

Global Scope

Intelligence Sources

AlienVault OTX 2026-09-14

Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users AlienVault OTX