# Twitch Extension Leaked Your Token? Disconnect Sessions > Used a Twitch browser extension that sent login tokens to an outside server? Learn how Twitch tokens stop working and the steps to cut off access safely. - URL: https://www.awarexone.com/research/twitch-extension-leaked-token-disconnect-sessions - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-31 - Topics: Twitch, Account Security, Browser Extensions - Related service: Account security help: https://www.awarexone.com/services/account-security ## Short answer Remove the extension from your browser first. Then change your Twitch password, which Twitch's developer docs say makes access and refresh tokens invalid. Open your Connections settings and disconnect any app you do not recognise or no longer use. Turn on two factor authentication, then log back in and reconnect only the tools you trust. ## Summary - BleepingComputer reported on 14 September 2026 that a Twitch browser extension with more than 30,000 installs sent users' OAuth tokens to a commercial bot service. - Twitch's developer docs say tokens stop working when they expire, when you change your password, when Twitch revokes them, or when you disconnect the app. - Remove the extension, change your Twitch password, check the Connections page for apps you do not use, and turn on two factor authentication. - Treat a Twitch token like a password. Twitch's own docs tell developers to safeguard tokens in exactly that way. - One wrong step can cost you the account, so know what you are doing before you start. You installed a handy Twitch add-on months ago. Now security news says an extension like yours was sending login tokens to an outside server. You might not have noticed anything strange on your channel, but a token is a key to your account. The good news is that Twitch's own documentation explains how to make those keys stop working. BleepingComputer [reported on 14 September 2026](https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/) that the extension Twitch Enhanced Viewer, also branded JeetBot, sent users' Twitch OAuth session tokens to servers run by a commercial bot service. The Hacker News [covered the same finding](https://thehackernews.com/2026/09/malicious-twitch-browser-extension.html). This guide uses Twitch's [authentication docs](https://dev.twitch.tv/docs/authentication/), its [token revocation docs](https://dev.twitch.tv/docs/authentication/revoke-tokens/), its [two factor help page](https://help.twitch.tv/s/article/two-factor-authentication) and the [Twitch Terms of Service](https://www.twitch.tv/p/en/legal/terms-of-service/). One wrong step can cost you the account, so know what you are doing before you start. Last checked: 31 October 2026. ## Quick Answer Remove the extension from your browser first. Then change your Twitch password, which Twitch's developer docs say makes access and refresh tokens invalid. Open your Connections settings and disconnect any app you do not recognise or no longer use. Turn on two factor authentication, then log back in and reconnect only the tools you trust. ## What Was Reported According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/), the extension had more than 30,000 installs and was listed in the official Chrome and Firefox stores as a tool to block ads, force full HD playback and collect channel points. Security firm Socket found that it forwarded users' tokens. BleepingComputer also quotes the developer disputing the malicious label and saying the setup served playback features. We take no position on intent. What matters for you is that a token left your browser. BleepingComputer reports that Socket recommended removing the extension, disconnecting all sessions in Twitch, and then logging in again, to invalidate any token that may have been sent. It also notes that older versions continued to send tokens, so updating alone may not be enough if you used one of them. ## How Twitch Tokens Stop Working Twitch's [authentication docs](https://dev.twitch.tv/docs/authentication/) tell developers to treat access tokens, refresh tokens and client secrets like a password. They list four reasons a token becomes invalid: - The token expires. - The user changes their password. - Twitch revokes the token. - The user disconnects the app from the /settings/connections page by clicking Disconnect next to its name. Twitch's [revocation docs](https://dev.twitch.tv/docs/authentication/revoke-tokens/) describe how an app can revoke a token it no longer needs. As a user, the two levers in your hands are changing your password and disconnecting apps. > Note: **Our reading.** Changing your password is the broadest step, because Twitch's docs say it invalidates tokens. Disconnecting a single app only cuts off that app. ## Step by Step Clean Up 1. Remove the extension from every browser where you installed it. 2. Change your Twitch password to a new, unique one. 3. Log back in and open your Connections settings at twitch.tv/settings/connections. 4. Disconnect any app or service you do not recognise or no longer use. 5. Turn on two factor authentication if it is not already on. 6. Check your channel for changes: stream key, chat settings, moderators, payout or email details. 7. Reconnect only the tools you trust, one at a time. Twitch's [two factor page](https://help.twitch.tv/s/article/two-factor-authentication) says that when you enable 2FA, you will be logged out of Twitch, and that an Authy account is created and linked to your phone number whichever authenticator app you use. It notes that Affiliates and Partners need 2FA turned on. ## What to Check on Your Channel *Our checklist. Twitch's docs cover tokens and connections; the rest is good practice.* | Area | What to look for | | --- | --- | | Account email and phone | Changes you did not make | | Moderators and editors | Names you did not add | | Stream key | Reset it if you suspect misuse | | Chat and follows | Follows, messages or chat actions you did not make | | Connections | Apps you do not recognise | If someone already changed your email or locked you out, go to our guide to [Twitch account hacked recovery](https://www.awarexone.com/research/twitch-account-hacked-recovery). If your account was suspended after activity you did not do, see our guide to [a Twitch suspension appeal](https://www.awarexone.com/research/twitch-account-suspended-appeal). ## Choosing Extensions More Safely - Install only extensions you need, from developers you can identify. - Be wary of extensions that promise ad blocking or channel point automation for Twitch, since these need deep access to your session. - Review your browser extensions every few months and remove unused ones. - The [Twitch Terms of Service](https://www.twitch.tv/p/en/legal/terms-of-service/) govern how you use the service, and automating actions with third party tools can conflict with them. ## Malaysian Streamers and Viewers Malaysian streamers and viewers use the same Chrome and Firefox stores as everyone else, and add-ons that promise better playback or fewer ads are tempting on slower connections. If you share a computer at home or at a cyber cafe, check every browser profile on that machine for the extension, not only your own. ## Signs a Token May Have Been Used A token gives an app the permissions it was granted, so misuse depends on what the extension could do. Look for activity that matches those powers rather than a full takeover. - Channels followed or unfollowed without your action. - Chat messages in channels you did not visit. - Channel point redemptions you did not make. - Changes to your profile, bio or panels. - New connected apps you did not approve. - Login or security emails from Twitch you did not expect. If you find any of these, note the date and time, then change your password and check Connections again. Reporting unexpected activity to Twitch through its help site gives you a record if your account is later restricted for actions you did not take. Keep your screenshots together with the date you removed the extension. ## For Streamers With Moderators and Bots If you run a channel with moderators, editors and chat bots, a leaked token is not only your concern. After you change your password, your own connected tools will need to log in again, and so may any bot that used your account's connection. Reconnect them one by one so you can spot anything that does not belong. - Tell your moderators what happened so they watch chat for odd activity. - Reconnect chat bots and overlays only from their official sites. - Ask editors to check their own browsers for the same extension. - Note the date in your channel records in case you need to explain activity later. Moderators and editors who installed the same extension should run the same steps on their own accounts, because their tokens carry their own permissions on your channel. A moderator token can still time out chatters or change chat settings even after your own password has changed, so ask each of them to change their password and check Connections. Keep a short note of who confirmed they have done it. Finally, check your browser sync settings. If Chrome or Firefox syncs extensions across your devices, removing the extension on one computer may not remove it everywhere, and it can come back after a sync. Remove it from each device, then confirm it has not returned the next day before you consider the clean up complete. ## When It Is Safer to Get Expert Help > Warning: **Tokens can outlast the extension.** Removing an extension does not cancel a token it already sent. Change your password so old tokens stop working. Removing the extension and changing your password is something you can do yourself in minutes. It is worth getting help when your email, stream key or payout details changed, when you are locked out, or when your channel earns money and you are unsure what the token was used for. Signing in through lookalike recovery pages after a scare can make matters worse. If your channel matters to your income or community, an experienced security review is the safer step. AwareXone does this work. See our [account security help](https://www.awarexone.com/services/account-security) page. ## When a Case Review Makes Sense A case review helps when you cannot get back into the account, when settings keep changing after a password reset, or when you need to show Twitch what happened. We are a Malaysia-based team, independent of Twitch, and we use only the official routes. We do not ask for your password, and we cannot promise a result. See how we work on our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### Does removing the extension protect my account? It stops new tokens being sent, but a token already sent may still work. Twitch's docs say changing your password makes tokens invalid. ### How do I disconnect apps from Twitch? Twitch's developer docs say users can open the /settings/connections page and click Disconnect next to an app's name. ### What is a Twitch OAuth token? It is a key that lets an app act on your account. Twitch tells developers to treat tokens like a password. ### Will turning on 2FA log me out? Twitch's help page says you will be logged out of Twitch when you enable two factor authentication. ### Which extension was reported? BleepingComputer reported on Twitch Enhanced Viewer, also branded JeetBot, in September 2026. The developer disputed the malicious label. ## Official sources - [Official: Authentication | Twitch Developers (read 31 October 2026)](https://dev.twitch.tv/docs/authentication/) - [Official: Revoking Access Tokens | Twitch Developers (read 31 October 2026)](https://dev.twitch.tv/docs/authentication/revoke-tokens/) - [Official: Setting up Two-Factor Authentication (2FA) (read 31 October 2026)](https://help.twitch.tv/s/article/two-factor-authentication) - [Official: Terms Of Service (read 31 October 2026)](https://www.twitch.tv/p/en/legal/terms-of-service/) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.