Today’s Topics:

• The Twitch Extension That Sent 31,000 OAuth Tokens Through Its Proxy Network
• When the Firewall Manager Becomes the Foothold
• How can Netizen help?

---

The Twitch Extension That Sent 31,000 OAuth Tokens Through Its Proxy Network

A browser extension promising better Twitch playback quietly created a much larger security problem. Nearly 31,000 Chrome and Firefox users had their live Twitch OAuth session tokens routed through proxy infrastructure controlled by the extension’s operator, placing credentials capable of acting on user accounts inside a network path users had little reason to suspect.

The extension, Twitch Enhanced Viewer | JeetBot, was published for Google Chrome in June 2025 and Mozilla Firefox in July 2025. Its Chrome listing accounted for roughly 30,000 users, with another 604 installations attributed to Firefox at the time of reporting. The extension advertised improved Twitch playback, including access to 1080p streams in regions where users could face viewing restrictions.

The security issue was buried inside the way that playback system worked.

Socket researcher Kush Pandya found that recent versions of the extension redirected Twitch video-playlist requests through proxy servers operated by JeetBot. During that redirect, the extension appended the user’s Twitch OAuth token to the request URL using an auth query parameter. That meant an authentication credential tied directly to the user’s active Twitch session crossed infrastructure operated outside Twitch itself.

The distinction matters. A Twitch OAuth session token is a bearer credential. Possession of the token can let another party act within the permissions associated with that session without entering the account password or completing a second-factor authentication challenge. Socket reported that exposed tokens could provide access to functions such as Twitch chat, private whispers, account settings, and channel-point activity.

The implementation created another problem: the token was inserted directly into the URL.

URLs frequently appear in HTTP request records, reverse-proxy telemetry, debugging systems, application logs, and other infrastructure. In this case, the report found that the OAuth token could be written in cleartext into the operator’s proxy request logs. A mechanism intended to make video playback work had effectively turned a session credential into ordinary request metadata.

The behavior was also repeated during normal use. Socket reported that current version 85.x builds forwarded the token for channels viewed through the affected playback path. This was not a single authentication event during setup. A user could repeatedly send the same live session credential through operator-controlled infrastructure as they moved between streams.

Researchers also found evidence that token transmission had changed over the extension’s development. An earlier 4.x version from January 2026 reportedly sent the token through a dedicated set-token endpoint, with backup infrastructure hosted on Deno domains. Later releases moved to the query-string method used by the proxy redirect. The mechanism changed, but the underlying trust decision remained the same: an active Twitch credential was leaving the Twitch authentication boundary and reaching infrastructure controlled by the extension operator.

JeetBot itself is broader than the extension. Its operator describes the service as a bot platform for Twitch, Kick, and VK Live with features such as text-to-speech, automatic translation, and viewer interaction tools. The service claims more than 26,000 active streamers and one billion processed messages. According to the report, the same commercial service operates the infrastructure through which affected Twitch sessions were routed.
Part of the initial research also focused on ten Twitch channels whose traffic followed a different path. Socket initially described them as a hardcoded allowlist that did not receive the same token-forwarding treatment. JeetBot developer Aleksandr Popov later explained that the list supported a playback workaround for channels that produced Twitch’s proxy or unblocker error for viewers outside Russia or using VPN connections. Starting with version 85.8.4, users could modify the list themselves through the extension interface.

That clarification changes the interpretation of the exception, but it does not remove the credential-handling problem.

Popov disputed describing the extension as malicious and said the tokens were sent to obtain Twitch stream playlists, not to conduct unauthorized activity against users’ accounts. He also pointed to other Twitch playback extensions that send OAuth tokens to remote servers to provide high-quality streams for Russian users. Those extensions, he said, disclose the behavior in their store listings. Popov acknowledged that JeetBot’s prior description and privacy policy did not adequately disclose its own token transmission.

JeetBot has since changed the implementation. According to its documentation, Firefox version 85.8.7 no longer sends the user’s OAuth token to JeetBot proxy servers. At the time of the report, an equivalent Chrome update had been submitted for store review. Users running an older release were told to disable the extension if an update was unavailable.

Updating the extension does not solve every part of the incident. JeetBot itself warned that disabling or upgrading the extension does not revoke tokens that were transmitted previously. Once a bearer credential has crossed an unintended trust boundary, stopping future transmission and invalidating the exposed credential are separate tasks.

The case also points to a larger browser-security problem. Extensions sit in an unusually trusted position. Depending on their permissions, they can observe pages, modify requests, interact with authenticated applications, read browser data, and redirect traffic. Users often evaluate them like small interface add-ons, yet their execution context can place them directly beside credentials, session state, and privileged web traffic.

For security teams, that makes extensions part of identity security, not merely browser configuration. An extension does not need to steal a password to expose an account. If it can access a live session token, API key, authentication cookie, or another bearer credential, it may reach the same result through a different path.

The JeetBot incident is a useful example of how that risk can emerge without a traditional exploit. There was no browser memory-corruption vulnerability, phishing page, or credential-stealing executable required. The exposure came from application design: retrieve a sensitive token, attach it to a network request, and send the request through infrastructure outside the authentication provider.

That type of failure can be harder for users to recognize. The extension still performs the feature they installed it for. Streams load. The browser shows no obvious compromise. Two-factor authentication remains enabled. Nothing necessarily looks abnormal from the user’s perspective.

Yet the credential protecting the session has already left the environment where the user expected it to remain.

For the roughly 31,000 users affected by the previous JeetBot implementation, that is the central issue. The incident was not simply about a Twitch playback extension sending unusual telemetry. It was about a browser component placing live bearer credentials into an external proxy path, demonstrating how quickly convenience features can become identity-security risks when session tokens are treated like ordinary application data.

---

When the Firewall Manager Becomes the Foothold

Cisco Secure Firewall Management Center is supposed to give defenders centralized control over firewall policy, managed devices, and network security operations. Recent intrusions show what happens when that same management layer falls under attacker control. Two Cisco FMC vulnerabilities have now been tied to three separate intrusion clusters involving credential theft, state-linked malware, internal network reconnaissance, and Qilin ransomware.

The attacks center on CVE-2026-20079 and CVE-2026-20316. CVE-2026-20079 is the more severe flaw, carrying a CVSS score of 10.0. It affects the FMC web interface and can let an unauthenticated remote attacker bypass authentication, execute scripts and commands, and gain root access to the underlying operating system. Cisco says the flaw stems from an improper system process created during boot. An attacker can trigger it through crafted HTTP requests. Cisco published the vulnerability in March 2026 and updated its advisory on September 9 after confirming active exploitation.

CVE-2026-20316 looks less severe on paper. Its CVSS score is 5.3, but its operational value is much greater than that number suggests. The flaw exposes static credentials for a low-privilege FMC account, allowing a remote unauthenticated attacker to log in and access sensitive information. Cisco rated the issue High rather than Medium since the account can be combined with other FMC weaknesses to gain greater privileges. Cisco confirmed exploitation of the flaw in July 2026, the same month the vulnerability was disclosed.

Cisco Talos has now connected exploitation of these flaws with three different post-compromise activity clusters. The cases show several attacker objectives converging on the same device class. One group used FMC access to extract authentication data. Another deployed tooling associated with a state-linked malware family. A third turned the compromised management server into an entry point for a Qilin ransomware operation.

The first cluster, tracked as UAT-12197, exploited CVE-2026-20079 and placed a JSP web shell inside the FMC Tomcat webroot. From there, the attackers deployed a malicious Java Archive named cmd.jar. The JAR operated as a command executor and was used to query FMC’s internal database through Cisco’s own OmniQuery.pl utility. One observed query requested user names and authentication data directly from the device’s database.

This part of the intrusion makes FMC a particularly valuable target. A compromised firewall-management system does not sit at the edge as an isolated appliance. It contains information that can help an intruder learn how the environment is organized, which systems are managed, and which credentials or configuration data may provide the next path inward. UAT-12197 appears to have recognized that value quickly, moving from code execution to credential collection rather than treating the FMC instance as an endpoint to compromise and abandon.

The second cluster, UAT-11823, went further. Talos assesses with high confidence that this is an advanced persistent threat actor whose tooling overlaps with the Sandworm group. The attackers gained access through CVE-2026-20079 or static credentials and modified a temporary license package to establish a Netcat reverse shell. The malicious package was then processed through FMC’s legitimate package_info.pl utility, which executes during the normal package-installation process with root privileges.

That technique gave the attackers a useful way to turn access to a lower-privilege account into operating-system-level execution. Rather than importing an entirely separate exploitation framework, the operation abused functionality already present on the FMC server. That same pattern becomes relevant again in the ransomware intrusion.

UAT-11823 also deployed shell scripts to collect configurations from devices managed by FMC. The configuration data was staged into archives for exfiltration, giving the attackers intelligence on systems sitting behind the compromised management plane.

The group then installed a variant of Cyclops Blink, a modular ELF implant previously attributed by U.S. and U.K. authorities to Sandworm. Talos found capabilities for persistence, DNS-over-HTTPS resolution, file transfer, credential collection, arbitrary command execution, network scanning, and packet sniffing. Talos stops short of declaring UAT-11823 identical to Sandworm, describing the activity instead as having strong overlap in tooling. That distinction matters when assigning an intrusion to a named state-sponsored group.

The third cluster shows how similar FMC access can support a very different objective.

Cisco tracks the operation as UAT-11988 and assesses with high confidence that the actor is a ransomware operator. In this case, the attacker gained access through the static credentials exposed by CVE-2026-20316, then abused legitimate FMC functionality to move from access to full internal reconnaissance.

The attacker again used package_info.pl, feeding it a malicious license.tmp package containing commands that ran with root privileges. From the FMC system, the operator collected host names, IP addresses, directory information, Active Directory service-account credentials, MySQL credentials, domain account data, computer-object lists, and mappings for sensitive infrastructure. The discovery activity identified systems including domain controllers, Active Directory Federation Services servers, Exchange servers, file servers, and database systems. Collected data was staged in files accessible through FMC and retrieved using HTTP GET requests.

At that point, the firewall manager had become an internal reconnaissance platform.

The attackers deployed a Python SOCKS5 proxy and established a reverse SSH tunnel from FMC back to infrastructure they controlled. Talos observed forwarding for services associated with LDAP, LDAPS, Kerberos, SMB, NetBIOS, and Windows Remote Management. That tunnel gave the operator a route from the compromised management device into authentication, file-sharing, and administrative services elsewhere in the victim environment.

The operation then shifted toward ransomware preparation. The attacker probed endpoints, used tools including Impacket and Invoke-TheHash, deployed custom antivirus killers, and assembled a target list of hosts selected for encryption. Qilin ransomware was then deployed to selected endpoints. Talos said the observed tactics matched those used by Qilin affiliates.

That sequence is what makes the campaign more significant than another case of an exposed edge appliance being exploited.

The attacker did not simply compromise FMC and use it as a disposable relay. The system became a bridge between external access and the internal environment. It supplied visibility into managed infrastructure, exposed credentials, provided root-level execution paths, supported traffic tunneling, and helped the operator determine where ransomware would have the greatest effect.

It also shows why vulnerability severity cannot be read from a CVSS score alone. CVE-2026-20316 carries a 5.3 score and initially provides a low-privilege account. In isolation, that can appear far less urgent than a remote root-level vulnerability such as CVE-2026-20079. The Qilin intrusion demonstrates how deployment context changes the risk calculation. A low-privilege account on a security-management platform can become the first link in a chain that ends with credential theft and ransomware across unrelated endpoints.

Cisco’s own rating reflects that concern. The company assigned CVE-2026-20316 a High severity rating and warned that the flaw can be chained with other FMC weaknesses for privilege escalation. The company also states that there are no workarounds for either vulnerability.

Cisco has released hotfixes for affected FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 branches. The company has advised customers to install the fixes rather than wait for its broader FMC hardening release, which Cisco announced for the week of September 16, 2026. The company also notes that keeping the FMC management interface away from direct public internet exposure reduces the available attack surface, though it does not replace patching.

Patching also does not clean an already compromised device. Cisco warns that its hotfixes prevent future exploitation but may not resolve an intrusion that has already occurred. For CVE-2026-20316, administrators can search FMC logs for package_info activity involving /var/tmp/license.tmp. Cisco advises customers that find signs of exploitation to contact its Technical Assistance Center for recovery guidance.

Talos has also released network detections and indicators tied to the campaigns. Snort rules 66075 through 66080 cover CVE-2026-20079, rule 66883 addresses CVE-2026-20316, and rules 66960 and 66961 target related malware activity. Published indicators include hashes for the UAT-12197 web shell and command executor, infrastructure associated with the UAT-11823 reverse shell and Cyclops Blink activity, and an IP address tied to the UAT-11988 intrusion.

Federal vulnerability guidance has followed the active exploitation. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on September 9 after evidence of real-world attacks emerged. CVE-2026-20316 had already entered the catalog on July 29, the day Cisco publicly disclosed the static-credential issue.

The larger lesson is about where security infrastructure sits in an attack path. Systems such as FMC occupy an unusual position: they are defensive products, but they also hold centralized knowledge about the networks they protect. An attacker who compromises that control point may gain far more than another Linux server. They can gain a map of the environment, access to security configurations, credentials associated with managed infrastructure, and a trusted system from which to reach deeper into the network.

The three clusters documented by Talos show three versions of that outcome. One used FMC to steal credentials. One used it to support an intrusion involving Cyclops Blink. One used the same class of system to prepare an enterprise for Qilin ransomware.

The firewall manager was supposed to help defenders control the network. In these intrusions, control of the firewall manager helped attackers learn which parts of the network to attack next.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---