MALICIOUS TWITCH BROWSER EXTENSION EXPOSES 30,000 USERS' OAUTH TOKENS TO RUSSIAN BOT SERVICE

Summary from the TLDR InfoSec newsletter

Socket found that a cross-store browser extension, 'Twitch Enhanced Viewer | JeetBot', captures account OAuth tokens from Twitch pages. Current Chrome and Firefox builds add tokens to proxy redirect URLs for most viewed channels, but earlier builds sent tokens directly to set-token endpoints. The extension has about 31,000 installs across both stores, and anyone holding a token can access chat, whispers, account settings, and channel points. Remove the extension, disconnect Twitch sessions, and re-authenticate.