[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fltZjKg0lwZNNLopFHB6KIed-BUTPc7cf1dWhxkryg7Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"2459931e-e86c-40a8-b755-9b4fe0d51383","malicious-browser-extension-harvests-oauth-tokens-from-31000-twitch-users","a5768edc-d943-4225-af07-3a557f88e3c7","Malicious Browser Extension Harvests OAuth Tokens from 31,000 Twitch Users","A fraudulent browser extension posing as a legitimate Twitch enhancement tool silently exfiltrated OAuth tokens from nearly 31,000 users by redirecting authentication traffic through attacker-controlled proxy servers. OAuth tokens are high-value credentials that grant persistent access to accounts without requiring a password, making their theft equivalent to full account compromise for chat, private messages, and settings. The extension successfully passed through both the Chrome and Firefox extension stores, demonstrating that official marketplaces cannot be fully trusted as gatekeepers of software safety. This attack exploits users' tendency to trust published browser extensions and their lack of visibility into what network requests those extensions are making in the background. The incident highlights how supply chain attacks increasingly target end-user software layers rather than traditional server-side infrastructure.","**Immediate actions:**\n- Remove the 'Twitch Enhanced Viewer | JeetBot' extension immediately and revoke all associated OAuth tokens via Twitch account settings.\n- Audit all installed browser extensions across your organization and remove any with unnecessary permissions or unknown publishers.\n- Reset passwords and re-authenticate on any Twitch account that had the extension installed.\n\n**Long-term improvements:**\n- Establish an organizational policy restricting browser extension installations to a pre-approved allowlist managed by IT\u002Fsecurity teams.\n- Implement browser management solutions (e.g., Google Workspace Admin, Intune) to enforce extension policies and block unauthorized installs.\n- Educate users to scrutinize extension permission requests, particularly those requesting access to 'all websites' or network traffic.\n\n**Detection measures:**\n- Deploy endpoint or browser telemetry monitoring to flag extensions making unexpected outbound connections to unknown or foreign-hosted proxy servers.\n- Integrate OAuth token activity logging and set alerts for tokens being used from anomalous IP addresses or geographies.\n- Periodically review installed extensions against known-malicious extension databases such as those maintained by CRXcavator or Extension Monitor.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.SC-3: Supply Chain Risk Management","GDPR Article 32: Security of Processing (for organizations handling EU user data)","ITIL: Change and Release Management (vetting third-party software)","NIST SP 800-167: Guide to Application Whitelisting",{},"published","2026-09-14T10:21:42.29925+00:00","2026-09-14T10:21:42.189+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmalicious-twitch-browser-extension.html","malicious-twitch-browser-extension-leaks-oauth-tokens-from-nearly-31-000-users-69430c","Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]