Actor Profile

HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commercial SaaS platform for Twitch, Kick, and VK Live streaming services, claiming over 26,000 active streamers and 1 billion processed messages. The actor's motivation appears primarily commercial, monetizing bot services while leveraging a malicious browser extension to harvest OAuth tokens from unsuspecting users. The extension was distributed across Chrome (30,000 users) and Firefox (604 users) platforms starting June-July 2025.

TTPs (Tactics, Techniques, Procedures)

The primary technique involved credential harvesting through a malicious browser extension (T1539 - Steal Web Session Cookie). The extension embedded code to extract Twitch OAuth tokens and forward them as cleartext query parameters (&auth=) to operator-controlled proxy servers during video-playlist requests to usher.ttvnw[.]net. Earlier v4.x builds (January 2026) used dedicated POST requests to set-token endpoints on the operator's infrastructure, with backup endpoints on deno.dev and deno.net. The extension employed social engineering (T1204.002 - Malicious File) by advertising legitimate features like ad-free viewing and region-unlocked 1080p streams to entice installation. A hardcoded allowlist of 10 Russian streamer channels was exempted from token forwarding, suggesting selective targeting and operational security considerations.

Targets & Patterns

The operation primarily targeted Twitch users in the technology and social media sectors, with a focus on viewers seeking enhanced streaming capabilities. The 31,000 compromised users span Chrome (30,000) and Firefox (604) platforms. The exemption of 10 specific Russian-language Twitch channels (with follower counts ranging from 2 to 1.1 million) from token harvesting suggests the actor may have relationships with these streamers or sought to avoid detection within Russian streaming communities. The targeting pattern indicates opportunistic credential harvesting from a broad user base while protecting specific Russian-language channels, possibly to maintain operational security or business relationships within the Russian streaming ecosystem.

Historical Context

The malicious extension was first published on Chrome Web Store on June 26, 2025, followed by Firefox Add-Ons on July 7, 2025. Earlier v4.x builds from January 2026 used more aggressive token exfiltration via dedicated POST endpoints, while current v85.x builds shifted to inline query parameter forwarding, possibly to reduce detection risk. The operation was exposed by Socket security researcher Kush Pandya in September 2026. Following disclosure, the operator acknowledged the issue as an "oversight" and released version 85.8.7 for Firefox with a Chrome update pending review. The JeetBot platform itself claims a longer operational history with over 26,000 active streamers, suggesting the malicious extension was layered onto an existing commercial bot service infrastructure.

Defensive Recommendations

  • Monitor browser extension installations and enforce allowlisting policies, particularly for extensions requesting broad permissions to social media and streaming platforms
  • Implement network monitoring to detect OAuth tokens transmitted in cleartext URL query parameters, especially to unexpected proxy infrastructure or non-standard domains
  • Revoke and rotate Twitch OAuth tokens for users who installed extensions from HISHIMIRO/jeetbot.cc (Chrome ID: pnhhdhhcadcjfckjhpmjneldiegbojfb, Firefox: twitchenhancedviewer@example.com) between June 2025 and September 2026
  • Deploy endpoint detection rules to identify browser extensions making POST requests to set-token endpoints or forwarding authentication credentials to third-party infrastructure, particularly deno.dev/deno.net domains
  • Educate users on the risks of installing browser extensions promising ad-free or region-unlocked content, and encourage review of extension permissions before installation

---

# Geopolitical Context

Geopolitical Context

This incident illustrates the persistent challenge of commercial dual-use infrastructure originating from jurisdictions with limited regulatory oversight of cyber operations. A Cyprus-registered developer operating a Russian-language bot-as-a-service platform distributed browser extensions that exfiltrated authentication credentials from nearly 31,000 Twitch users across Chrome and Firefox ecosystems. The technical implementation—routing OAuth tokens through operator-controlled proxy servers while exempting a hardcoded list of ten predominantly Russian-language streamers—suggests a business model optimized for monetizing credential access within specific linguistic and regional communities. The case underscores how legitimate-appearing productivity tools can serve as vectors for credential harvesting, particularly when developer incentives, regulatory environments, and platform review processes fail to align. While the developer characterizes the token transmission as an "oversight" now being remediated, the architectural design choices—including dedicated token-posting endpoints and selective exemption of specific channels—indicate functionality that extended beyond inadvertent logging. This pattern is consistent with broader trends in commercialized access-as-a-service offerings that blur boundaries between gray-market tooling and malicious infrastructure.

State Actor Alignment

The developer, identified as Cyprus-based Aleksandr Popov, operates commercial bot infrastructure serving Russian-language streaming platforms (Twitch, Kick, VK Live). While there is no evidence linking this activity to state-directed operations, the incident reflects a permissive operating environment for credential-harvesting services that target Western social media platforms. Cyprus's role as a jurisdiction of registration for developers operating Russian-language commercial infrastructure warrants attention from regulators examining cross-border data flows and platform security. The selective exemption of Russian-language streamers from token forwarding—while routing credentials from the broader user base through operator-controlled servers—suggests market segmentation consistent with protecting a core Russian-speaking customer base while monetizing access to international users. This incident does not appear to involve state-sponsored espionage but rather commercial exploitation enabled by jurisdictional arbitrage and platform review gaps. No sanctions implications are apparent, though the case may inform policy discussions around browser extension vetting and cross-border credential handling.

Business Impacty pro region

For European users and regulators, this breach highlights enforcement challenges under GDPR and the Digital Services Act, particularly regarding third-party extensions that process authentication credentials without adequate disclosure. The developer's Cyprus registration—within the EU—combined with infrastructure serving Russian-language markets, exemplifies regulatory complexity in addressing cross-border data exfiltration. Platform providers (Google, Mozilla) face renewed scrutiny over extension review processes that allowed credential-harvesting code to remain available for over a year. The incident may accelerate calls for mandatory security audits of browser extensions with elevated permissions, particularly those handling OAuth tokens. For the broader technology sector, the case underscores supply chain risks inherent in browser extension ecosystems, where third-party code executes with extensive privileges across user sessions. The 31,000 affected users—predominantly accessing Twitch content—may face secondary risks including account takeover, privacy violations through chat/whisper access, and potential use of credentials in follow-on operations. The incident also illustrates how commercial bot services can create systemic platform integrity risks by aggregating access to tens of thousands of authenticated sessions.

Forecast

If the developer's remediation (version 85.8.7+) successfully eliminates token forwarding and gains widespread adoption, the immediate credential leakage will cease, though previously harvested tokens remain valid until users manually revoke them or Twitch implements platform-wide token rotation. If platform providers (Google Chrome Web Store, Mozilla) do not expedite review and potential removal of non-compliant versions, additional users may install vulnerable builds, extending exposure. If Twitch does not proactively invalidate tokens for affected users, those credentials may be exploited for account takeover, spam operations, or sale on credential markets. If regulators in the EU pursue enforcement action under GDPR for inadequate disclosure and unlawful processing, this case may establish precedent for developer liability in extension-based credential harvesting. If browser vendors implement stricter OAuth handling policies or mandatory disclosures for extensions accessing authentication tokens, similar commercial services may face increased compliance costs or market exit. Longer-term, if this incident prompts industry-wide review of extension permission models, we may observe a shift toward more restrictive OAuth scopes and enhanced user consent mechanisms for credential-handling extensions. The commercial viability of bot-as-a-service platforms operating through browser extensions will likely face increased scrutiny, potentially driving such services toward more opaque distribution channels or jurisdictions with weaker platform governance.