Researchers reported that a popular Twitch browser extension sent users’ Twitch OAuth login tokens to proxy servers controlled by the extension’s developer. If a token was exposed, someone receiving it could potentially act as the account holder without needing the user’s password. The key user risk is that uninstalling or updating the extension may not automatically revoke tokens that were already transmitted.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You install a Twitch helper called “Twitch Enhanced Viewer | JeetBot” from the official Chrome store… and it quietly gets the power to be you. Researchers found this JeetBot extension was grabbing your Twitch OAuth token from your logged-in session and sending it through JeetBot-controlled proxy servers, letting someone act as your account without your password. Here’s the trap: the extension says it routes playlists through its proxy to unlock 1080p in restricted regions, but that video feature does not need full read/write account access. And even if you uninstall it, any token it already sent can still work. If you’ve ever used a Twitch enhancement extension like this, don’t just delete it, log into Twitch, kill old sessions and connected apps, and scan your account activity for anything you don’t recognize.
Researchers found a real phishing campaign abusing npm packages and unpkg mirrors to host a convincing fake Cloudflare CAPTCHA page on a trusted domain. Victims who click the mirrored link are redirected to attacker-controlled infrastructure that could deliver ClickFix-style prompts or credential…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
The article describes how real-world attackers are shifting common breach activity into the web browser, including phishing that steals live sessions, fake “copy/paste to fix” prompts (ClickFix), and OAuth consent/device-code tricks. It highlights how these browser-based lures can bypass MFA and…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
