Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
socket.dev
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.

cross-posted from: https://piefed.world/c/tech/p/1400813/popular-twitch-ad-blocker-caught-sending-live-account-credentials-to-russian-proxies

Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing.

  • GasMaskedLunatic@lemmy.dbzer0.com
    34·
    15 hours ago

    A Google vetted source allowing code that compromises the end user? That’s simply not possible. The developer had to provide an ID to publish the code. It MUST be safe! /s

    • alapakala@quokk.auOPEnglish
      1·
      15 hours ago

      There are closed sourced web browser addons‽
      I swear all Manifest V3 & XPI are source readable.
      Though Russian is a req…

        • alapakala@quokk.auOPEnglish
          2·
          14 hours ago

          nah, I earnest believe every person ðt installd ↓ just didn’t boðer readŋ éðr code. Decompression is somθŋ every1 does. Ur internet connection can’t work wo/it. I haven’t botherd checkŋ if it has obfuscation.

          • Linearity@piefed.zipEnglish
            6·
            11 hours ago

            Mate what is this language
            I’ve made a v2 extension for Firefox, you CAN have obfuscated code in an extension by compiling it. HOWEVER, Mozilla requires you to submit the source code for any compiled/obfuscated code. Google has no reason not to catch it.
            Compressed XPI packages can still be read afaik, they’re just JavaScript, CSS and HTML files at the end of the day.

            • alapakala@quokk.auOPEnglish
              1·
              10 hours ago

              Google has no reason not to catch it.

              Apparently lying on threadiverse is also a requirement, seeing as you have no problems with it. JeetBot made no attempt to obfuscate their credential requiring addon, for other API means than to do both.

              This was “Я верю в это.” No afterthought, no review.

              • Linearity@piefed.zipEnglish
                3·
                10 hours ago

                Apologies, but I do not understand the argument you’re trying to make nor the part in my comment where I lied.

                • alapakala@quokk.auOPEnglish
                  1·
                  9 hours ago

                  After Google created v3 manifests, all chrome addons MUST be readable. It’s simply JS, HTML, & JSON in a ZIP.