A Twitch-related browser add-on distributed through the official Chrome and Firefox extension stores, with roughly 30,000 users, was found transmitting viewers' Twitch OAuth session tokens to an outside commercial bot operation. Those tokens can grant account access, putting affected users' accounts at risk of takeover.
Read the full story at Bleeping Computer