Malicious JetBrains plugins have been identified in a coordinated malware campaign targeting developers, stealing AI API keys from the JetBrains Marketplace. Researchers at Aikido Security have uncovered at least 15 malicious plugins that have collectively amassed nearly 70,000 installations, with the campaign starting in late October 2025 and continuing until June 2026.
See also: 108 malicious Chrome extensions steal Google and Telegram data
JetBrains plugins were presented as code helpers based on artificial intelligence models such as DeepSeek, OpenAI , and SiliconFlow. They offered features like chat, automatic commit message generation, code review, debugging, and unit test generation — and they worked exactly as promised. The problem was hidden in the background: once the user entered AI provider API key in the settings and clicked Apply, the key was silently sent to a server under the attackers’ control.
According to Aikido Security researcher Ilyas Makari , the exploit was technically simple but extremely effective. The data extraction logic was embedded in the save() method of the configuration handler, and the key was sent over HTTP in plaintext format to the address hxxp://39.107.60[.]51/api/software/key . Using plain HTTP instead of HTTPS means that the key traveled without any encryption, exposed to anyone monitoring network traffic.
How the AI API keys theft scheme worked
The JetBrains plugins were distributed through seven different vendor accounts on the Marketplace, suggesting an organized operation rather than isolated opportunistic attacks. The two most popular plugins were DeepSeek AI Assist with 27,727 downloads and CodeGPT AI Assistant with 25,571 downloads. However, Aikido Security noted that these numbers may be inflated, as the listings also contained fake five-star reviews to make them appear trustworthy.
Of particular concern was the existence of a monetized secondary tier: users who paid a small amount through the built-in donation wall received back a working AI API key from the attackers’ server. This means that the attackers were using the victims’ stolen keys to serve paid users — a scheme reminiscent of the well-known LLMjacking, where stolen credentials are used to gain mass access to AI at a cost to the victims. As Makari put it: “The operator collects money on one side and free credentials on the other, while the legitimate key holders foot the bill.”
See also: JetBrains IntelliJ IDE bug exposes GitHub access tokens
All 15 malicious plugins shared a similar codebase, which had simply been renamed and repackaged for each listing — a tactic that suggests automated or semi-automated mass publishing. An example plugin ID reported is ord.cp.code.ai.kit. The campaign fits into a broader pattern of supply-chain attacks on trusted developer ecosystems, where attackers exploit the trust developers have in official marketplaces.
Alongside the discovery of the malicious JetBrains plugins, researchers have identified two Google Chrome that masquerade as ad blockers but eavesdrop on users’ conversations with AI chatbots. The operation, dubbed PromptSnatcher by researcher Jean-Marie R. , targeted users of OpenAI ChatGPT, Anthropic Claude, Google Gemini, Microsoft Copilot, Perplexity, DeepSeek, xAI Grok , and Meta AI.
Together, the two incidents reveal a worrying trend: cybercriminals are increasingly turning their attention to AI credentials and data generated by AI tools. AI API keys are now high-value targets, as their theft can lead to unauthorized use of models, unexpected charges to your cloud account, and the potential exposure of sensitive prompts or results related to confidential projects.
See also: JetBrains clarifies its plans for integrating dependencies into Ktor
Aikido Security recommends that developers treat every plugin like any dependency running with its own privileges. Specifically, organizations should review and remove suspicious plugins from developers' machines, revoke and replace any AI API keys entered into affected plugins, monitor AI service usage and charges for anomalous activity, and store secrets in dedicated secrets managers instead of IDE plugin settings.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
