Malicious Twitch Extension Exposed More Than 31,000 Users’ Session Tokens

Summary

Researchers say the Twitch Enhanced Viewer extension stole session tokens from more than 31,000 users by routing authenticated requests through external proxies, where credentials could be recorded in cleartext logs.

Key points

The malicious Twitch Enhanced Viewer extension was listed on the Chrome Web Store and Firefox Add-ons marketplace.
Researchers report more than 30,000 Chrome installs and over 500 Firefox installs.
The extension monitored streaming sessions and intercepted authorization tokens in media requests.
It routed requests through external proxy servers and placed tokens in URLs, exposing them in cleartext access logs.
Earlier versions reportedly sent tokens directly to collection endpoints; the extension also exempted ten specified Russian streamer channels from harvesting.
Stolen tokens could enable account hijacking, private-message access, chat posting, and spending account points.
Users should remove the extension and disconnect active sessions to invalidate compromised tokens; security teams can audit for the add-on and block known proxy connections.

Article Details

Attack Vectors: The extension was distributed through Chrome Web Store and Firefox Add-ons listings, where it was promoted as a video-quality and ad-blocking add-on.
After installation, the extension monitored browser tabs, extracted active authorization headers, and attached bearer tokens to proxied media-request URLs.
The extension routed streaming traffic through proxy servers associated with the bot service, exposing tokens in cleartext access logs.
Defensive Notes: Remove the extension from Chrome and Firefox, then disconnect all active account sessions to invalidate compromised tokens.
Audit endpoint browsers for unauthorized add-ons and block connections to known proxy servers operated by the bot service.
Restrict browser permissions that allow traffic rerouting on authenticated platforms and regularly review installed extensions.