Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, distributed through the official Chrome Web Store and Mozilla Add-ons, forwarded OAuth session tokens to proxies under the control of its operator. With these tokens, an attacker can hijack accounts without needing a password or second factor, allowing actions ranging from reading and sending whispers to writing in chat and altering linked account settings.
The tokens function as bearer credentials: whoever possesses them can operate as the authenticated user. The most critical behavior appeared in the v85.x branch, where the extension added the token as the &auth= query parameter during network-level redirects to the operator’s proxy infrastructure. Because the token traveled inside a URL, it could remain in clear text inside proxy logs, greatly increasing exposure if those logs were accessed or leaked.
The forwarding occurred for nearly every channel a user opened, with the exception of a default list of ten channels. Starting with version 85.8.4, the extension also introduced a Channels with restrictions parameter that gave the appearance of control while the underlying exfiltration continued. Earlier v4.x releases had already sent tokens via POST to a set-token endpoint and maintained backup endpoints hosted on deno.dev and deno.net.
The correction is available in Firefox from version 85.8.7, which eliminates token transmission by altering the playlist retrieval method. The developer stated that an equivalent patch for Chrome is being prepared. Updating or disabling the extension stops further leakage, yet it does not invalidate tokens that have already been sent.
Recommended actions include immediately uninstalling or disabling Twitch Enhanced Viewer | JeetBot, revoking all active Twitch sessions from account settings, forcing re-authentication, and reviewing recent activity, private messages, and chat actions for unauthorized use. In managed environments, organizations should inventory installed extensions, block the affected identifiers pnhhdhhcadcjfckjhpmjneldiegbojfb in Chrome and twitchenhancedviewer@example.com in Firefox, and enforce allow-list policies for corporate browsers.
Related articles
Malicious ZIP Archive Delivers Git-Based Remote Code Execution via Hooks and Filters
A developer received a fake job offer from Cryptic Heaven through LinkedIn, leading to a ZIP file containing a rigged Git repository. The archive included a pre-configured .git directory with altered hooksPath pointing to .git/objects/interrupt and a custom clean filter named ltr. Upon git status or branch checkout, the setup triggered a shell script that downloaded and executed remote code from a server hosted on vercelscript.vercel.app. The attack leveraged post-checkout hooks and Git filters to run silently without requiring install scripts or explicit execution. Multiple trigger paths existed, including automatic detection in Visual Studio Code, Git-aware terminal prompts, and following README instructions to switch branches. The technique worked on both Linux/macOS and Windows through Git for Windows shell support. The incident highlights risks of opening untrusted Git repositories delivered outside standard clone workflows.
OIDC-Based Push Deployment on VPS Removes SSH Keys from CI While Enforcing Strict Isolation
A new self-hosted deployment system called cd enables secure continuous delivery to single Linux VPS hosts running Docker without storing any long-lived secrets in CI repositories. The architecture relies on short-lived OIDC JWT tokens issued by GitHub Actions or GitLab CI, verified on the target server through JWKS public keys. The server component cdd performs token validation, archive checks, resource-limited builds inside BuildKit, health checks, and automatic rollback on failure. All containers are launched with read-only root filesystems, dropped capabilities, no-new-privileges, and network binding restricted to 127.0.0.1 behind Caddy or Nginx. Administrative control is provided by the cdctl CLI that registers projects, sets RAM/CPU limits, and manages DNS records via Porkbun integration. The entire solution avoids external databases, web panels, and persistent secrets while enforcing one-repository-to-one-application boundaries.
Stolen Credentials Poison cPGuard Update Channel, Turning Security Software into Data Theft Backdoor
Attackers used compromised OPSSHIELD credentials to hijack the cPGuard update distribution network on November 2 at 02:06 UTC, injecting malicious scripts into versions 5.88.12 through 5.88.19. The poisoned updates targeted Linux servers running the security tool, which holds root privileges on hosting provider and cloud infrastructure machines. The script harvested /etc/shadow, /etc/passwd, MariaDB/MySQL root credentials from my.cnf, root shell history containing API tokens, and SSH authorized_keys files before exfiltrating them via the vendor's own infrastructure. A persistent backdoor was also dropped at /var/tmp/.cpg91511_sh. OPSSHIELD detected the intrusion within 12 hours and halted distribution, but confirmed that 32 customer servers had their data accessed. The incident highlights risks of relying on static credentials for security product update pipelines without code signing or behavioral restrictions.
Polymarket Suffers Supply Chain Attack via Compromised DebugBear Monitoring Script
Attackers compromised DNS records of DebugBear, a real user monitoring provider, to inject malicious JavaScript into Polymarket pages. The script extracted wallet data and trading credentials from browser storage, then used the platform's official relayer to execute unauthorized withdrawals totaling approximately $2.7 million across 737 wallets. No smart contract vulnerabilities were exploited; all 985 unauthorized transactions carried valid user signatures. The incident occurred on October 29 and was resolved within an hour after trading was halted, with Polymarket returning $3.9 million including compensation. This attack class matches the 2023 Ledger Connect Kit compromise, highlighting risks from third-party scripts in browser sessions. Polymarket has since committed to stricter CSP policies, script pinning, and sandboxing. The case underscores that browser-based sessions with full API privileges remain a critical trust boundary in crypto platforms.