Poisoned Pipeline / Incidents / AS142

AS142 · 2026-09

Twitch browser extension leaks 30k OAuth tokens

Browser extensions

Socket: a Twitch browser extension exposed about 30,000 users’ OAuth
tokens to a Russian bot service.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/malicious-twitch-browser-extension