Guillaume LapointeA wave of Twitch account takeovers reported through July 2026 has hit streamers who thought two-factor authentication made them untouchable — and in several cases the attackers rerouted creators' payouts before anyone noticed. Content creators including Kionafu, SasugaReina and HimeMysti have said publicly that intruders reached their channels and changed payment settings even though 2FA was switched on, according to reporting by Dot Esports and win.gg. Twitch has said it is investigating.
For the thousands of Canadians who now earn part or all of their living on Twitch, YouTube and Kick, the incident is a blunt reminder that "I have 2FA" is no longer the end of the security conversation. Here is what actually happened, why your authenticator app did not save these streamers, and the steps an IT security professional would tell you to take today.
What happened to the compromised streamers
Multiple creators reported the same pattern within days of each other: they logged in normally, then discovered that their registered payout method had been quietly swapped to an account they did not control. SasugaReina noted that she used an authenticator app — generally stronger than SMS codes — and was still breached, as covered by win.gg.
The detail that alarmed security researchers is the timing. Several streamers said Twitch did not require a fresh 2FA check at the moment the payout method was changed. That means once an attacker was "inside," they could redirect money without tripping the very safeguard most creators rely on.
Why two-factor authentication was bypassed
The leading explanation from cybersecurity analysts is not that 2FA "failed" in the classic sense. It is that the attackers never needed your password or your code at all. The technique is known as session-token hijacking, or a "pass-the-cookie" attack.
When you log in and complete your 2FA challenge, the site hands your browser a session cookie — a small token that says "this person is already verified, let them back in without asking again." If malware on your computer steals that cookie, the attacker can load it into their own browser and walk straight past the login screen. From the platform's point of view, the intruder simply looks like you, already authenticated.
These cookie-stealing payloads usually arrive disguised as something a streamer would plausibly open: a "game demo" from a supposed sponsor, a sponsorship contract in a downloadable file, or a browser extension promising better stream analytics. One careless click can hand over a token that renders even an authenticator app irrelevant. The CyberSec Guru's write-up on the incident describes exactly this session-hijack mechanism.
A second weak point is email. If an attacker controls your inbox, they can often trigger a password reset that unwinds your account protection entirely — 2FA included.
Why this is a Canadian small-business problem, not just a gamer story
It is tempting to file this under "gamer drama," but the people most exposed are effectively running micro-businesses. A mid-sized Canadian streamer may collect subscription revenue, bits, sponsorship fees and merch income through a single connected account. A hijacked payout setting is not a lost password — it is a diverted paycheque, and often GST/HST-registered business income at that.
The Government of Canada's Get Cyber Safe program stresses that multi-factor authentication remains essential precisely because it stops attackers who already have your password — but it also publishes guidance for the situation these streamers are now in: recovering a hacked account. Reacting fast, and in the right order, materially changes how much you lose.
What an IT security expert would tell you to do now
If you earn money on a streaming platform, treat your account like a payment terminal, because that is what it has become.
- Assume the device is the real target. Run a reputable anti-malware scan and remove browser extensions you did not deliberately install. A stolen cookie almost always starts with something running on your machine.
- Log out of all sessions. In Twitch's security settings, use "disconnect all sessions" (and the equivalent on any linked platform). This invalidates stolen cookies so a hijacker's copy stops working.
- Lock down the email first. Your inbox is the master key. Give it its own strong, unique password and its own MFA, ideally with a hardware key or passkey rather than SMS.
- Re-verify your payout details manually. Do not trust that they are unchanged — open the settings and read the account number yourself.
- Prefer phishing-resistant MFA. Hardware security keys and passkeys defeat many token-theft and phishing tricks that authenticator codes alone cannot.
When to bring in a professional
For a hobbyist, the checklist above is usually enough. For a creator whose income depends on the channel — or a small agency managing several talents' accounts — this is the moment to consult an information technology specialist rather than improvise.
An IT professional can audit which devices and third-party apps are connected to your account, deploy endpoint protection that flags cookie-stealing malware, migrate your logins to passkeys or hardware keys, and set up a monitored recovery email that an attacker cannot silently take over. If money has already moved, they can also help you preserve the evidence — session logs, IP records, change timestamps — that both the platform and your payment provider will ask for during a dispute.
The uncomfortable lesson from July 2026 is that a green "2FA enabled" badge is a floor, not a ceiling. The streamers who lost payouts did almost everything the old advice recommended. Closing the remaining gap — the device, the browser session, the email account — is exactly the kind of work worth handing to an expert before, not after, someone is loading your cookie into their browser.
