Cybersecurity Brief - September 14, 2026

• Malicious Twitch Extension Leaks OAuth Tokens: A malicious Chrome and Firefox extension, "Twitch Enhanced Viewer | JeetBot," has been found leaking the OAuth tokens of approximately 31,000 users to Russian-operated proxy servers. The extension captures credentials via URL query parameters, potentially allowing unauthorized access to user chats, private messages, and account settings. (Source: The Hacker News)

• Microsoft Targets Passkey Phishing Campaigns: Microsoft has revealed threat actors are utilizing phishing campaigns that leverage passkey-themed social engineering to compromise Microsoft Cloud accounts and exfiltrate sensitive data. The campaign also includes large-scale financial fraud via fraudulent emails masquerading as corporate executives. (Source: The Hacker News)