Malicious JetBrains plugins steal AI API keys from 70,000 developer installations

Malicious JetBrains Marketplace plugins steal AI API keys from developers

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. The campaign, discovered by Aikido Security, includes plugins that act as AI coding assistants, code-review tools, and Git utilities powered by popular AI services such as OpenAI, DeepSeek, and SiliconFlow. "We detected a coordinated malware campaign on the JetBrains Marketplace," warns Aikido. "At least 15 IDE plugins, published under seven vendor accounts, share the same hidden behavior. Each one exfiltrates the AI provider API key that you stored into its settings, and together they have been installed close to 70,000 times." According to Aikido, the malicious plugins were first published in October 2025, with new plugins continuing to be published as recently as June 10, 2026. The researchers say the plugins function as advertised, but secretly transmit AI API keys entered by users into the plugin settings back to the attackers. According to the report, the theft occurs when a user clicks "Apply" after entering an API key, causing the credential to be sent to a hardcoded server at 39.107.60[.]51 over HTTP at this URL: The researchers found that all 15 plugins share similar code that were submitted as different Marketplace plugins. Aikido also discovered functionality that allows the remote server to provide AI API keys to paid users. While it is unclear where these API keys are coming from, Aikido theorizes that the plugin operators may be harvesting credentials from the free users and then providing them to the paid users. "The plugins also run a paid tier. After a user pays a small fee through the donation wall built into the plugin, the server sends an API key back down to the client, and the plugin starts using that key for its model calls instead of your own, which is bizarre, since no legitimate operator would simply hand a user a working and unrestricted key to a paid AI provider," says Aikido. BleepingComputer downloaded and analyzed the latest version of the DeepSeek AI Assist plugin (plugin ID: ord.cp.code.ai.kit) and independently confirmed that it still contains the credential theft code described in Aikido's report. At the time of writing, the plugin remained available for download through the JetBrains Marketplace. The campaign plugins discovered by Aikido are: * DeepSeek Junit Test (org.sm.yms.toolkit) * DeepSeek Git Commit (com.json.simple.kit) * DeepSeek FindBugs (org.bug.find.tools) * DeepSeek AI Chat (org.translate.ai.simple) * DeepSeek Dev AI (com.yy.test.ai.simple) * DeepSeek AI Coding (com.dev.ai.toolkit) * AI FindBugs (com.json.view.simple) * AI Git Commitor (com.my.git.ai.kit) * AI Coder Review (org.check.ai.ds) * DeepSeek Coder AI (com.review.tool.code) * AI Coder Assistant (org.code.assist.dev.tool) * DeepSeek Code Review (com.coder.ai.dpt) * CodeGPT AI Assistant (com.my.code.tools) * DeepSeek AI Assist (ord.cp.code.ai.kit) * Coding Simple Tool (com.dp.git.ai.tool) The two most downloaded plugins are DeepSeek AI Assist (27,727 downloads) and CodeGPT AI Assistant (25,571 downloads). However, the researchers warn that download counts can be manipulated and should not necessarily be treated as unique installations. While malicious packages are commonly discovered on repositories such as npm and PyPI, reports of credential-stealing plugins distributed through the JetBrains Marketplace are far less common. BleepingComputer contacted JetBrains about the malicious plugins, but has not received a response as of publication.

Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

Cybersecurity researchers have flagged a "coordinated malware campaign" on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys. "Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests," Aikido Security researcher Ilyas Makari said. "They function exactly as advertised. However, the AI provider API key you enter gets exfiltrated to a server controlled by the attacker." The activity is said to have been ongoing since the end of October 2025, with new plugins released as recently as June 10, 2026. Two of the plugins, CodeGPT AI Assistant and DeepSeek AI Assist, have more than 25,000 downloads each, although it's not clear if the counts are authentic or if they have been inflated to fake their popularity. The complete list of plugins is below - * DeepSeek Junit Test (org.sm.yms.toolkit) * DeepSeek Git Commit (com.json.simple.kit) * DeepSeek FindBugs (org.bug.find.tools) * DeepSeek AI Chat (org.translate.ai.simple) * DeepSeek Dev AI (com.yy.test.ai.simple) * DeepSeek AI Coding (com.dev.ai.toolkit) * AI FindBugs (com.json.view.simple) * AI Git Commitor (com.my.git.ai.kit) * AI Coder Review (org.check.ai.ds) * DeepSeek Coder AI (com.review.tool.code) * AI Coder Assistant (org.code.assist.dev.tool) * DeepSeek Code Review (com.coder.ai.dpt) * CodeGPT AI Assistant (com.my.code.tools) * DeepSeek AI Assist (ord.cp.code.ai.kit) * Coding Simple Tool (com.dp.git.ai.tool) Aikido Security said all 15 plugins share a similar codebase, requiring users to open the settings panel and enter an API key for an AI like OpenAI, SiliconFlow, or DeepSeek in order to carry out the promised functionality. While the plugins work as they are intended to, they have been found to sneak in the ability to covertly siphon the provided API key to a remote server ("39.107.60[.]51") under the attacker's control over an HTTP request in plaintext format. "The plugins also run a paid tier," the company said. "After a user pays a small fee through the donation wall built into the plugin, the server sends an API key back down to the client, and the plugin starts using that key for its model calls instead of your own, which is bizarre, since no legitimate operator would simply hand a user a working and unrestricted key to a paid AI provider." This has raised the possibility that the operators behind the campaign are likely sharing the stolen AI provider API keys with other threat actors as part of an illicit monetization scheme, effectively turning it into a service that grants paying users access to the victim's AI provider. "The operator collects money on one side and free credentials on the other, while the genuine key owners pay the bill," Makari added. The campaign is further evidence of how threat actors are increasingly targeting developer environments through the open-source ecosystem, which has become a lucrative target owing to the fact that they host source code, cloud credentials, signing keys, and API keys for paid AI services that can be resold for LLMjacking schemes. "Treat a plugin the same way you would treat any dependency that runs with your privileges, and be cautious about pasting long-lived secrets into tools you have not vetted," Aikido Security said. Malicious Chrome Extensions Steal AI Conversations The development coincides with the discovery of two Google Chrome ad blocker extensions that have been caught capturing users' conversations with AI chatbots like OpenAI ChatGPT, Anthropic Claude, Google Gemini, Microsoft Copilot, Perplexity, DeepSeek, xAI Grok, and Meta AI. The data collection operation has been codenamed PromptSnatcher by researcher Jean-Marie R. The names of the extensions, which are still available on the Chrome Web Store, are as follows - * Smart Adblocker (ID: iojpcjjdfhlcbgjnpngcmaojmlokmeii) - 90,000 users (Published in October 2022) * Adblock for Browser (ID: jcbjcocinigpbgfpnhlpagidbmlngnnn) - 10,000 users (Published in August 2023) "While presented as ad blockers, the extensions ship a custom-built interception engine that records non-public conversations, model usage, and account-tier metadata from every major AI platform (ChatGPT, Claude, Gemini, and others)," the researcher said. "The operation uses legitimate public filter lists (EasyList, IDCAC) as functional cover, providing genuine ad-blocking utility while running an undisclosed telemetry channel." The fact that the two extensions have been around for several years indicates that the AI-related updates were introduced in the form of software updates. These efforts are part of an attack technique called Prompt Poaching. Over the past several months, browser extensions, both legitimate and malicious, have been observed adopting this method to stealthily capture AI chats. What's unclear is whether these practices violate Google's policies for browser extensions. "The extensions intercept full AI conversation history, model usage, and subscription tier from eight platforms, and transmit this data to operator-controlled infrastructure without notification to the user beyond a generic 'Enhanced Protection' consent string," the researcher noted.