Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

A fraudulent browser extension posing as a legitimate Twitch enhancement tool silently exfiltrated OAuth tokens from nearly 31,000 users by redirecting authentication traffic through attacker-controlled proxy servers. OAuth tokens are high-value credentials that grant persistent access to accounts without requiring a password, making their theft equivalent to full account compromise for chat, private messages, and settings. The extension successfully passed through both the Chrome and Firefox extension stores, demonstrating that official marketplaces cannot be fully trusted as gatekeepers of software safety. This attack exploits users' tendency to trust published browser extensions and their lack of visibility into what network requests those extensions are making in the background. The incident highlights how supply chain attacks increasingly target end-user software layers rather than traditional server-side infrastructure.