1 article on this topic.
A Chrome and Firefox extension marketed as a Twitch "viewer enhancer" quietly forwarded users' live OAuth session tokens to the proxy infrastructure of a commercial Russian view-bot service — no phishing page or malware payload required.