Researchers reported that a popular Twitch browser extension sent users’ Twitch OAuth login tokens to proxy servers controlled by the extension’s developer. If a token was exposed, someone receiving it could potentially act as the account holder without needing the user’s password. The key user risk is that uninstalling or updating the extension may not automatically revoke tokens that were already transmitted.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You install a Twitch helper called “Twitch Enhanced Viewer | JeetBot” from the official Chrome store… and it quietly gets the power to be you. Researchers found this JeetBot extension was grabbing your Twitch OAuth token from your logged-in session and sending it through JeetBot-controlled proxy servers, letting someone act as your account without your password. Here’s the trap: the extension says it routes playlists through its proxy to unlock 1080p in restricted regions, but that video feature does not need full read/write account access. And even if you uninstall it, any token it already sent can still work. If you’ve ever used a Twitch enhancement extension like this, don’t just delete it, log into Twitch, kill old sessions and connected apps, and scan your account activity for anything you don’t recognize.
Researchers found a real phishing campaign abusing npm packages and unpkg mirrors to host a convincing fake Cloudflare CAPTCHA page on a trusted domain. Victims who click the mirrored link are redirected to attacker-controlled infrastructure that could deliver ClickFix-style prompts or credential…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
