piefed - Link to source

Popular Twitch ad blocker caught sending live account credentials to Russian proxies

cross-posted from: piefed.world/c/tech/p/1400813/popular-twitch-ad-blocker-caught-sending-live-account-credentials-to-r…

Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing.

Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.
Kush Pandya (Socket)
in reply to Carlos Solís
piefed - Link to source

alapakala

nah, I earnest believe every person ðt installd ↓ just didn't boðer readŋ éðr code. Decompression is somθŋ every1 does. Ur internet connection can't work wo/it. I haven't botherd checkŋ if it has obfuscation.
in reply to alapakala
piefed - Link to source

Linearity

Mate what is this language
I’ve made a v2 extension for Firefox, you CAN have obfuscated code in an extension by compiling it. HOWEVER, Mozilla requires you to submit the source code for any compiled/obfuscated code. Google has no reason not to catch it.
Compressed XPI packages can still be read afaik, they’re just JavaScript, CSS and HTML files at the end of the day.
in reply to Linearity
piefed - Link to source

alapakala

Google has no reason not to catch it.


Apparently lying on threadiverse is also a requirement, seeing as you have no problems with it. JeetBot made no attempt to obfuscate their credential requiring addon, for other API means than to do both.

This was “Я верю в это.” No afterthought, no review.

Evolution of morality - Wikipedia

Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)

Privacy reshared this.

in reply to alapakala
piefed - Link to source

Linearity

I did not mention Google not having this measure (nor was I aware of it), I only stated what I knew. And this only proves my argument further anyway: Google has no reason not to catch it. (“it” being the malicious extension)
There were no lies in my comment but you jumped the gun, accused me of lying and were rude about it too.

Calling out misinformation is good, just please be politer.

in reply to Linearity
piefed - Link to source

alapakala

Politeness is a ladder. The extension isn't still malicious: it does what it says. It just the tradeoff is getting your API credentials stolen. Calling twitchenhancedviewer “obfuscated” is pure disinformation, as we can both see both codes, Firefox's & Chrome’s.
in reply to alapakala
lemmy - Link to source

sovietknuckles [she/her]

The media in this post is not displayed to visitors. To view it, please go to the original post.
Popular

4 reviews on Firefox Browser Add-Ons


I wouldn't install an add-on that hasn't been vetted with, at the very least, more positive reviews.

I use Alternate Player for Twitch.tv on Firefox, which also has a Russian developer, but it has 4.2 stars and 895 reviews

Also,

Dev email is twitchenhancedviewer@example.com
Esta entrada fue editada (lunes, 14 de septiembre de 2026, 20:12)