Malicious Twitch extension leaks live session tokens from about 30,000 users

Researchers at Socket found that a browser extension called "Twitch Enhanced Viewer," installed by roughly 30,000 Chrome and Firefox users, secretly forwards users' live Twitch session tokens to proxy servers run by a Russian-language bot service. Those tokens let anyone holding them act on the account without the password or two-factor authentication. The extension's advertised features, like ad blocking, forced 1080p, and region unlocking, are real and serve as cover: to deliver them it routes Twitch's video requests through operator-controlled proxies and skims the authentication token along the way. Earlier versions posted stolen tokens to a dedicated collection endpoint. Affected users should remove it and sign out of all Twitch sessions.

Check

Remove the Twitch Enhanced Viewer extension if installed, then sign out of all Twitch sessions to invalidate stolen tokens, and review installed browser extensions that hold account or broad site permissions.

Affected

Users who installed the extension on Chrome or Firefox; it forwards their live Twitch session tokens to a third party, granting account access without the password or two-factor authentication.

Fix

Restrict browser extension installation by policy, review and limit extension permissions, treat any extension that can read authenticated sessions as high-risk, and invalidate sessions if a token-stealing extension was used.