Popular Twitch ad blocker caught sending live account credentials to Russian proxies

With every passing week, it looks like browser extensions are becoming more and more of a security risk. A fresh report from security researchers at Socket found that a popular Twitch extension called Twitch Enhanced Viewer has been quietly funneling user login credentials straight to servers run by a Russian bot network.

The extension is available on Chrome and Firefox. If you look at it, it looks like any other handy utility. It promises to block preroll ads, bypass regional restrictions, and even collect channel points on autopilot. Sounds simple enough, right?

Much like those free VPN extensions caught snooping on clipboard data a couple of months ago, the useful features were real, which helped it build a trusting base of over 30,000 Chrome users and several hundred on Firefox. But the real issue lies in what it does behind the scenes.

According to details shared in the report, the Twitch Enhanced Viewer extension grabs your live Twitch login token and attaches it directly to the video playback requests routed through external proxy servers.

This is similar to what happened with the crypto trader add-ons that we reported on just last week. In that case, the attackers bypassed device security simply by piggybacking on an active login session and stole live sessions from crypto traders.

Since the Twitch token gets logged in plain text on the operator proxy servers, anyone with backend access can just open up your Twitch account with zero pushback.

The researchers at Socket warned that this token lets an attacker “act on the account without the password or a second factor,” meaning they can read private whispers, send messages in chat, or spend points at will.

One interesting detail is that the extension code deliberately skips forwarding tokens for ten Russian Counter-Strike streamers, while every other channel gets routed without warning.

All of this directly contradicts the developer store page, which claimed the tool “does not collect, store, or process any user data”. This means that anyone who isn’t tech-savvy might trust the description blindly and install the extension.

If you have Twitch Enhanced Viewer installed, get rid of it right away.

Then, jump into your Twitch account settings, click Disconnect on all active sessions, and log back in to revoke any tokens that were sent out.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.