According to recent reports "Twitch Enhanced Viewer JeetBot" was forwarding users' live Twitch session tokens to proxy servers run by a Russian commercial bot service.
Roughly 30,000 installs on Chrome was reported.
What that means in practice
Session token is what keeps you logged in. Anyone holding one can act as you on Twitch without needing your password and without triggering even two-factor authentication.
It's account-scoped rather than limited to video playback, so it reaches chat, whispers and account settings.
The extension sold itself as a quality-of-life tool: block ads, force 1080p, unlock regions, auto-collect channel points. Those features are real and they work, which is why people installed it.
Ten Russian-language streamer channels were exempted. Everywhere else, it forwarded.
What to do
- Remove the extension from your browser
- Go to Twitch account settings and disconnect all sessions
- Sign back in
Step two is the one that matters. Uninstalling stops future forwarding but does nothing about tokens already sent, which stay valid until the session is killed. Signing out everywhere invalidates them.
The fix, and why it doesn't close this
After Socket published, the JeetBot team acknowledged the risk and shipped a patch.
Firefox version 85.8.7 no longer forwards the token. Socket confirmed it in the code. The same fix has been submitted to the Chrome Web Store and is awaiting review, so the current Chrome build still forwards. Anyone running older code keeps forwarding until it updates.
Which means a Chrome user reading this today is still exposed.
Earlier builds from January went further, sending tokens to a dedicated collection Endpoint with two backups. That endpoint is gone from current versions.
The disclosure problem
The Chrome listing said the developer "disclosed that it will not collect or use your data."
JeetBot has acknowledged that its store description and privacy policy didn't adequately cover what the extension did. The company also announced a fix for the issue.
More:Twitch to Sue Russian Streamer
Read
Source Editing
Visual Editing
Related news
