posted in Technology
Popular Twitch ad blocker caught sending live account credentials to Russian proxies
cross-posted from: https://piefed.world/c/tech/p/1400813/popular-twitch-ad-blocker-caught-sending-live-account-credentials-to-russian-proxies
socket.dev/blog/malicious-twitch-browser-extensionThreat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing.
socket.devMalicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot ServiceA Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.