Twitch Enhanced Viewer | JeetBot — OAuth Token Forwarding Hunt Pack

“Twitch Enhanced Viewer | JeetBot” is a cross-store browser extension (Chrome Web Store ID pnhhdhhcadcjfckjhpmjneldiegbojfb, ~30,000 installs; Firefox add-on ID twitchenhancedviewer@example.com, ~552-604 installs) that markets itself as an ad-blocking, 1080p-forcing, region-unlocking Twitch quality-of-life tool and auto-collects channel points. That functionality is real, and it is the cover. To deliver it, the extension redirects Twitch video-playlist requests through operator-controlled proxy servers, and current builds (v85.2.2 and later, current v85.6.1) append the user’s live Twitch OAuth bearer token inline as an &auth= query parameter on that redirect, exposing it in plaintext in the proxy operator’s request logs.

Socket’s Threat Research Team attributes the proxy infrastructure (jeetbot.cc, morphilina.me) to a Russian commercial view-botting service, with roughly 30,000-31,000 affected users across both stores. Ten Russian-language streamer channels are hardcoded as exempt from token forwarding — an attribution signal, not a hunt indicator. Anyone holding a forwarded token can read chat, send whispers, spend channel points, and change account settings on the victim’s Twitch account with no password and no two-factor authentication.

Defender priority: the token capture and the query-parameter forwarding happen inside the browser’s own process and TLS-encrypted network stack, which is largely invisible to endpoint telemetry. The durable, actionable signal on a managed fleet is on-disk extension presence and DNS/network egress to jeetbot.cc and morphilina.me infrastructure — treat this primarily as a browser-extension governance problem, not a process-based malware hunt.

Three sources were fetched in full and saved verbatim as plain-text snapshots before any content in this pack was written. No fetched source contained text directed at an automated reader (no instructions to change tooling, fetch further URLs, skip steps, or claim prior authorization); all three were treated strictly as data to analyze, per standing security policy.

Provenance decisions

• Both SHA-256 package hashes and all three proxy IP addresses (152.53.177.186, 132.243.113.25, 80.74.26.162) appear only in the Socket.dev snapshot among the three saved sources. Per standing policy that anything shipping at prevent/critical severity needs two independent sources, these ship in the IOC table and the CSV appendix at severity: high (not critical) with an explicit single-source note, not as auto-block entries.
• Config endpoint URL paths (/api/v1/proxies, /api/v1/forced-proxy, /api/v2/public/extension_helper/, the legacy /set-token) are documented in the IOC table as context only. Falcon CQL cannot inspect URL paths inside encrypted HTTPS traffic, so these are never shipped as CQL regex targets — only the domains are.
• The deno.dev / deno.net backup endpoints referenced for the retired v4.x build are shared multi-tenant developer platforms. They are noted in prose for historical context only and are deliberately not shipped as blockable indicators — blocking them would collaterally break unrelated legitimate applications.
• The 10-channel allowlist (pch3lk1n, fasoollka, flamie, dosia, fander, almazer, forzorezor, akyuliych, lagoda1337, lagoda) is carried forward as an attribution/context signal only, per the seed intel’s explicit instruction, never as a detection or block indicator.

Hunt hypotheses

• H1 (high confidence). Any endpoint issuing DNS resolutions for jeetbot.cc or morphilina.me infrastructure has the extension installed and active. MITRE T1090.002/T1041. Telemetry: DnsRequest. FP: low — domains are unique to this campaign. → Q1.
• H2 (medium confidence). A browser process holding an outbound connection to 152.53.177.186 / 132.243.113.25 / 80.74.26.162 is proxying Twitch traffic through JeetBot infrastructure. MITRE T1090.002. Telemetry: NetworkConnectIP4. FP: medium — the underlying hosts (netcup GmbH, CLODO Cloud) are shared infrastructure that can be reassigned. → Q2.
• H3 (high confidence). Scoping H1 to a confirmed browser process (chrome/msedge/firefox/brave/opera) rules out unrelated infrastructure scanning and raises confidence to IOA-candidate level. MITRE T1176/T1090.002. Telemetry: DnsRequest joined to ProcessRollup2. FP: low. → Q3.
• H4 (medium confidence). Fleet-wide prevalence of H1 hits should be a small, actionable list, not background noise, given the domains are campaign-specific. Telemetry: DnsRequest, 30-day lookback. FP: low. → Q4.
• H5 (medium confidence). Repeated/recurring connections from a browser process to the proxy IPs (not a single connection) indicate persistent, ongoing extension activity rather than a one-off. Telemetry: NetworkConnectIP4 joined to ProcessRollup2, 7-day lookback. FP: medium (see H2). → Q5.

Two attack-chain steps have no mappable Falcon telemetry and are carried forward as explicit gaps rather than silently dropped: the in-browser Authorization-header capture (step 2 below) and the query-string token forwarding itself (step 5). Both are addressed in Section 15.

Attack chain

Confidence reflects source corroboration across the three saved snapshots; action follows the pack’s standard vocabulary (detect = block/alert, hunt = investigate, enrich = context only, pivot = investigation expansion). Rows marked single-source stay below detect/critical per standing two-source policy.

These checks require no CQL and directly cover the extension-governance gap noted in Section 15.

Chrome / Edge (Chromium) — managed browser extension inventory

• Google Admin console → Chrome browser cloud management → Apps & extensions → Users & Browsers report — search extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb across all managed browsers (Edge honors the same Chromium extension ID space if the extension was sideloaded from the Chrome Web Store).
• Microsoft Intune / Edge Business inventory — same extension ID, if Edge extension reporting is configured.

Firefox — enterprise policy inventory

• about:policies#json in-browser, or inspect distribution/policies.json directly, for the ExtensionSettings block covering twitchenhancedviewer@example.com.

RTR one-time fleet sweep (read-only, point-in-time)

Run via Falcon Real Time Response across the fleet to confirm on-disk presence. See the Browser Policy Audit quick-copy block in Section 10 for the exact commands.

Perimeter DNS / secure web gateway logs

Query Umbrella / Zscaler / firewall logs for jeetbot.cc and morphilina.me. Unlike Falcon, a web gateway typically logs the full request path, so this is the only telemetry source that can confirm whether the specific config endpoints (/api/v1/proxies, /api/v1/forced-proxy, /api/v2/public/extension_helper/, the legacy /set-token) actually fired.

User-facing remediation (not enterprise telemetry)

Any user confirmed to have installed the extension should sign out of Twitch on all devices and sign back in — this invalidates the exposed OAuth token — and review the Twitch account security/activity log for unauthorized whispers, chat activity, or settings changes.

Honesty note: this threat's actionable signal is domain/IP infrastructure, not a distinctive process command-line or image-path pattern. A classic Falcon Custom IOA (behavioral, process-tree/command-line based) is a poor fit here — the browser process itself (chrome.exe, firefox.exe) is completely legitimate and unmodified. The correct Falcon-native controls are Custom IOC entries and promoted Scheduled Searches, not a bespoke Custom IOA rule.

The Falcon IOC Management CSV below is the only block whose atomic indicators are mechanically traced to the saved source snapshots. The other three blocks are practical quick-copy references (extension IDs, mechanism, attribution, audit commands) that are not Falcon-importable IOC types.

type,value,action,severity,expiration,description,tags
sha256,e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8,detect,high,2027-03-14,JeetBot Chrome extension package (single-source: Socket.dev),campaign:jeetbot ext:chrome
sha256,141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc,detect,high,2027-03-14,JeetBot Firefox add-on package (single-source: Socket.dev),campaign:jeetbot ext:firefox
domain,jeetbot.cc,detect,high,2027-03-14,JeetBot umbrella domain (apex + subdomains host proxy/config infra),campaign:jeetbot
domain,enhanced.jeetbot.cc,detect,high,2027-03-14,Default OAuth-token-forwarding proxy,campaign:jeetbot
domain,enhanced-1.jeetbot.cc,hunt,medium,2026-12-14,Secondary proxy (single-source: Socket.dev),campaign:jeetbot
domain,ext-03.jeetbot.cc,hunt,medium,2026-12-14,Alternate proxy; resolves 80.74.26.162,campaign:jeetbot
domain,ext-styles.jeetbot.cc,detect,high,2027-03-14,Config API (/api/v1/proxies /api/v1/forced-proxy),campaign:jeetbot
domain,api.jeetbot.cc,hunt,medium,2026-12-14,Config API (/api/v2/public/extension_helper/),campaign:jeetbot
domain,proxy.morphilina.me,detect,high,2027-03-14,Token-strip proxy,campaign:jeetbot
domain,alexue4.dev,enrich,medium,2026-10-14,Attribution: copyright holder in extension metadata,campaign:jeetbot
ipv4,152.53.177.186,hunt,medium,2026-12-14,netcup GmbH AS197540 -- shared hosting; re-validate ownership before block,campaign:jeetbot
ipv4,132.243.113.25,hunt,medium,2026-12-14,CLODO Cloud AS216154 -- shared hosting; re-validate ownership before block,campaign:jeetbot
ipv4,80.74.26.162,hunt,medium,2026-12-14,CLODO Cloud AS216154 -- shared hosting; re-validate ownership before block,campaign:jeetbot

# Extension identifiers (not Falcon IOC-Management-importable types -- track via browser policy, see Section 12/13)
chrome_extension_id: pnhhdhhcadcjfckjhpmjneldiegbojfb
firefox_addon_id: twitchenhancedviewer@example.com

# Exfil pattern -- network-layer redirect, current builds v85.2.2+
query_param: &auth=${encodeURIComponent(authToken)}

# Legacy mechanism (v4.x, Jan 2026, superseded by v85.2.2)
legacy_endpoint: POST enhanced.jeetbot.cc/set-token

# Attribution allowlist -- exempted from token forwarding, NOT a hunt indicator
allowlisted_channels: pch3lk1n, fasoollka, flamie, dosia, fander, almazer, forzorezor, akyuliych, lagoda1337, lagoda

Extension name:      Twitch Enhanced Viewer | JeetBot
Chrome Web Store ID: pnhhdhhcadcjfckjhpmjneldiegbojfb (~30,000 users)
Firefox Add-on ID:   twitchenhancedviewer@example.com (~552-604 users)
Store handle:        HISHIMIRO
Attributed developer: Popov Aleksandr Alekseevich (as reported by Socket / The Hacker News)
Operator contact:    support@jeetbot.cc

Version history:
  v4.x     (Jan 2026)   direct POST token exfil to /set-token, backups on deno.dev/deno.net
  v7.2.6   (Apr 2026)
  v85.2.2  (May 2026)   switched to inline &auth= query-parameter forwarding
  v85.6.1               current version at publication (Sep 2026)
  v85.8.7 (Firefox)/equiv. Chrome -- post-disclosure remediation per THN reporting

# Chrome/Edge (Windows) -- ExtensionInstallBlocklist registry check
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"

# Firefox -- enterprise policy check
# open about:policies#json in-browser, or inspect distribution/policies.json for ExtensionSettings

# RTR fleet sweep for on-disk presence (read-only, point-in-time)
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions\pnhhdhhcadcjfckjhpmjneldiegbojfb" -ErrorAction SilentlyContinue
Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles\*\extensions\twitchenhancedviewer@example.com.xpi" -ErrorAction SilentlyContinue

Telemetry ready

DnsRequest and NetworkConnectIP4 must be enabled and flowing for endpoints that run a browser (default Falcon sensor policy covers both on Windows/macOS). Confirm with #event_simpleName=DnsRequest | groupBy(ComputerName, function=count(), limit=10) against a small pilot group before relying on Q1-Q5.

Benign baseline

Run Q1 and Q4 with a 30-day console lookback and confirm a zero (or near-zero, fully explained) baseline before enabling Q1/Q3 as a Scheduled Search. Any pre-existing hits should be triaged as already-compromised endpoints, not tuned away.

Positive tests

Validate Q1 and Q3 against a controlled DNS lookup to a lab-owned host resolving through the actual jeetbot.cc/morphilina.me domains (or, safer, a synthetic domain following the same regex) before trusting the query in production. Do not resolve the live campaign domains from a production endpoint for testing.

Promotion

Q1 and Q3 are the IOA/Scheduled-Search candidates (CONF high, FP low). Q2, Q4, and Q5 remain investigate-only pending periodic IP-ownership revalidation, per the shared-hosting caveat in Section 8.

Playbook 1 — Chrome/Edge ExtensionInstallBlocklist (Windows, GPO/registry)

Prerequisites: local admin or GPO/Intune push rights to HKLM\SOFTWARE\Policies. Reboot required: no — Chrome/Edge re-read policy on next browser restart. Rollback: remove the registry value (or the whole ExtensionInstallBlocklist key) to restore installability; note that Chrome does not automatically reinstall an extension it already force-removed under this policy — a user would need to manually reinstall if the block is later lifted, which is not recommended.

New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" -Name "1" -Value "pnhhdhhcadcjfckjhpmjneldiegbojfb" -PropertyType String -Force

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist" -Name "1" -Value "pnhhdhhcadcjfckjhpmjneldiegbojfb" -PropertyType String -Force

Verify: Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" returns the extension ID, and chrome://policy / chrome://extensions on a test endpoint show the extension blocked and removed.

Playbook 2 — Firefox enterprise policy (cross-platform)

Prerequisites: write access to distribution/policies.json (Windows: %ProgramFiles%\Mozilla Firefox\distribution\policies.json; macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json; Linux: /etc/firefox/policies/policies.json), or an equivalent MDM/GPO push. Reboot required: no — restart Firefox to pick up the policy. Rollback: remove the twitchenhancedviewer@example.com entry from ExtensionSettings and restart Firefox.

{
  "policies": {
    "ExtensionSettings": {
      "twitchenhancedviewer@example.com": {
        "installation_mode": "blocked",
        "blocked_install_message": "This extension is blocked by IT security policy."
      }
    }
  }
}

Verify: about:policies#json shows the block entry; about:addons no longer allows installing or re-enabling the add-on ID.

Playbook 3 — Fleet-wide RTR inventory sweep (read-only)

Prerequisites: Falcon RTR enabled and admin rights to run a batch RTR script. Reboot required: no. Rollback: none required — this is a read-only inventory check, not a configuration change.

Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions\pnhhdhhcadcjfckjhpmjneldiegbojfb" -ErrorAction SilentlyContinue | Select-Object FullName
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Edge\User Data\*\Extensions\pnhhdhhcadcjfckjhpmjneldiegbojfb" -ErrorAction SilentlyContinue | Select-Object FullName
Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles\*\extensions\twitchenhancedviewer@example.com.xpi" -ErrorAction SilentlyContinue | Select-Object FullName

Verify: RTR batch output lists any endpoint where a path was returned; cross-reference against Q1/Q3 network hits to prioritize remediation order.

Validation gates (Section 11, summarized): telemetry readiness confirmed via a pilot DnsRequest/NetworkConnectIP4 check; benign baseline required before promoting Q1/Q3; positive-test against a lab host, never the live campaign domain, before production use; Q1 and Q3 promote to Scheduled Search, Q2/Q4/Q5 stay investigate-only pending periodic IP revalidation.