Twitch Enhanced Viewer | JeetBot, a browser extension promising ad-free Twitch, 1080p and auto channel points, was sending users’ login tokens to a bot company’s servers, where they sat in plain text in its logs. It had more than 30,000 installs on Chrome and Firefox. That token lets someone act as you without your password. The developer says version 85.8.7 has stopped sending tokens, but that’s their claim, not an independent check.
The move
Remove the extension, then disconnect all sessions in your Twitch settings and log back in — that kills any token already taken. 2FA alone won’t stop someone using an already-stolen token.
Practise it: Permission Panic →
Seen via BleepingComputer