JeetBot extension validates stolen Twitch OAuth token via id.twitch.tv

Ankit Mehta@Secvyn

•updated 25 days ago•1•0•2

Detects browser processes (Chrome or Firefox) originating from specific file paths or extension IDs attempting to perform OAuth validation against the Twitch API. This behavior is indicative of potentially malicious browser extensions or extensions masquerading as legitimate tools attempting to handle user authentication tokens.