Popular Twitch ad blocker caught sending live account credentials to Russian proxies
cross-posted from: https://piefed.world/c/tech/p/1400813/popular-twitch-ad-blocker-caught-sending-live-account-credentials-to-russian-proxies
Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons ([email protected], 552 users). Both listings are live at time of writing.
https://socket.dev/blog/malicious-twitch-browser-extensionOpen linkView original on piefed.world
24 replies
I am shocked. Shocked, I say!
Well not that shocked.
Damn, now the Russians know what vtubers I've been gooning to.
That's what joystick is for, silly
Realistically those oath tokens get sold to scrapers and bots. The suspicious activity goes on your account and you can get an account ban
(don’t know if that bans you from Amazon, but if we were all banned from Amazon, that would be better for the world).
Shouldn't be surprised. Entire thing is in Russian
https://addons.mozilla.org/en-US/firefox/addon/twitch-enhanced-viewer/
There is a script you can find that autoblocks twitch ads if you set it up properly. It’s popular but, I forgot it, it uses Ublock origin.
Twitch Adblock Solutions on github? Developer rage quit in disgust of Amazon and archived the repo.
This is the current darling extension to use:
https://github.com/GosuDRM/TTV-AB
It'll use the standard definition preview stream until the ads stop playing, then switch to the regular stream.
he probably meant this: https://github.com/pixeltris/TwitchAdSolutions
Aye, the vaft userscript still worked as of 3 months ago but idk now if it still does. Only until Twitch updates and breaks it again. On purpose or not.
Does uBlock do a bad job?
For Twitch it does, they inline the video ads with the stream, uBlock can't do anything about that, and if you have a blocker that does work Twitch just infinitely refreshes the stream trying to force the video ad.
I still don't understand why people aren't using ublock in 2026.
Probably how they fuel their viewbot operations.
Just wanted to say that's a great little pixel art graphic for the story. I'm confident it's not ai, because i like it.
it doesnt really adhere to any pixel grid. many pixel artists also dont adhere to a grid, but ai REALLY doesnt.
Sorry but I really think it's AI. The only time I played around with AI of any kind was to see how it'd handle pixelart and it looked very similar to this. It's good at a very quick glance but quickly falls apart (like a lot of AI things) as soon as you actually look at it.
I don't see how a human could mess it up that oddly and badly. It would take more effort to make it this bad than just make actual pixel art, there are so many small things that make no sense as errors or sloppy/lazy human art.
What's wrong and bad about it, in your opinion? I'm no pixel art expert, but it sounds like you may be?
I can’t speak to the pixel are but the website itself also looks ai generated (as in the design not necessarily the writing). Also its homepage advertises its services as ai powered.
Yeah, I had a peek too. It might be ai, but I haven't seen any actual evidence of it - they use this pixel art style on a lot of their posts and it seems consistently decent.
Looking at their company photo they're very well funded and also have a team of like 60 people, so there's no reason they couldn't have an in-house graphics artist or a freelancer they contract. Or it could be ai.
But in times where every modern graphics artists is being accused of being AI, I'm inclined to assume not rather than assume it is, without evidence to the contrary.
I get what you’re saying but I mean the website itself with the layout, button designs, and dynamic elements (the fading in elements on scroll is very common in ai generated web design.
This should not even be in a pixel art
Uhh.. Its the icon for a browser plugin.. To illustrate that it was a Twitch browser plugin.
Yeah but you see, it's a pixel art, it should not be there and should be bigger, to match the pixel grid, this image has a ton of pixel not matching a grid and mixel (mixel can be an artistic choice but here they were clearly abused, i can give it the benefit of the doubt but that icon is too sus...)
You sound like you know your pixel art so I'm gonna take your word for it that this is sus. Appreciate the explanation.