[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvEZ-YAaZpRGVF8BuwXjnzIs5bdCXKwOAEGQcP9q75-w":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a5768edc-d943-4225-af07-3a557f88e3c7","Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users","malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31-000-users-69430c","A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named \"Twitch Enhanced Viewer | JeetBot,\" lists HISHIMIRO\u002Fjeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome -","A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has been found to leak OAuth tokens for almost 31,000 users. These tokens are sent to proxy servers operated by a Russian commercial bot service, potentially allowing access to user chats, private messages, and account settings. The extension, available on both Chrome and Firefox stores, claims to offer enhanced Twitch features but redirects requests through malicious infrastructure.","Malicious Twitch browser extension leaks OAuth tokens of nearly 31,000 users.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmalicious-twitch-browser-extension.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEguNgykDjufnR6xGrMUSq67eZ5sCFxbYjf8J6pEXekhUnt-zCt2xaJ4jzj6I0wPMYjps9z2ufKJ-JSJ8ZqhGe4BcbtNWfRETdaB6QgIRVLw0CtnsM5q2qCpyI3kL7oBXmNixcTTcumZJHFgCKaoLY8kRIBDbPHslMmmzzb25TlESGooJuaxtXEL5qrUzkop\u002Fs1600\u002Ftwitch.jpg","2026-09-14T07:24:39+00:00","2026-09-14T10:00:12.032096+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Twitch Enhanced Viewer | JeetBot","product",{"name":21,"type":22},"Twitch","vendor",{"name":24,"type":25},"OAuth","technology",{"name":27,"type":19},"Google Chrome Web Store",{"name":29,"type":19},"Mozilla Firefox Add-Ons store","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"domain","jeetbot.cc","Developer domain associated with the malicious extension.",{"type":34,"value":54,"context":55},"JeetBot","Name of the malicious Twitch browser extension.",[21,18,27],{"controls":58,"vendors":140},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":47,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":109,"product_name":110,"url":111,"description":112},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":114,"name":115,"problem":116,"products":117},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[118,126,133],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":114,"product_name":130,"url":131,"description":132},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":137,"url":138,"description":139},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":156},"malicious-browser-extension-harvests-oauth-tokens-from-31000-twitch-users","Malicious Browser Extension Harvests OAuth Tokens from 31,000 Twitch Users","A fraudulent browser extension posing as a legitimate Twitch enhancement tool silently exfiltrated OAuth tokens from nearly 31,000 users by redirecting authentication traffic through attacker-controlled proxy servers. OAuth tokens are high-value credentials that grant persistent access to accounts without requiring a password, making their theft equivalent to full account compromise for chat, private messages, and settings. The extension successfully passed through both the Chrome and Firefox extension stores, demonstrating that official marketplaces cannot be fully trusted as gatekeepers of software safety. This attack exploits users' tendency to trust published browser extensions and their lack of visibility into what network requests those extensions are making in the background. The incident highlights how supply chain attacks increasingly target end-user software layers rather than traditional server-side infrastructure.",[146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.SC-3: Supply Chain Risk Management","GDPR Article 32: Security of Processing (for organizations handling EU user data)","ITIL: Change and Release Management (vetting third-party software)","NIST SP 800-167: Guide to Application Whitelisting",{}]