Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Malicious Twitch Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
Excerpt
A browser extension marketed as a Twitch enhancement tool has been found forwarding live OAuth session tokens belonging to more than 30,000 users to proxy infrastructure linked to a Russian-language bot service. Socket’s Threat Research Team identified the extension, named “Twitch Enhanced Viewer | JeetBot,” across both the Chrome Web Store and Firefox Add-ons repository. The Chrome version, tracked as extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb , had roughly 30,000 users,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | api.jeetbot.cc | High | Score 58/100 | First seen |
| Domain | enhanced.jeetbot.cc | High | Score 58/100 | First seen |
| IP | 152.53.177.186 | High | Score 58/100 | First seen |
| Domain | proxy.morphilina.me | High | Score 58/100 | First seen |
| SHA256 | 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc | Medium | Score 53/100 | First seen |
| Domain | enhanced-1.jeetbot.cc | High | Score 58/100 | First seen |
| SHA256 | e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 | Medium | Score 53/100 | First seen |
| Domain | jeetbot.cc | Medium | Score 50/100 | First seen |
IOC Relationship Graph
Building graph…