A fake Twitch viewing extension exposed OAuth tokens through proxies, risking account takeovers for nearly 31,000 users.