Malicious JetBrains Marketplace Plugins Steal AI API Keys from Developers

MALICIOUS JETBRAINS MARKETPLACE PLUGINS STEAL AI API KEYS FROM DEVELOPERS

OverviewA coordinated campaign has been uncovered on the JetBrains Marketplace involving at least 15 malicious plugins. These plugins pose as AI-powered coding assistants, code-review tools, and Git utilities, but their hidden functionality is designed to siphon API keys belonging to popular AI providers. The discovery was announced by Aikido Security, which notes that the same covert behavior is embedded across multiple plugins published under seven different vendor accounts. The operation has been active since October 2025 and continued into June 2026, with installation counts approaching 70,000 across all affected plugins. The attackers reportedly exfiltrate API keys entered into the plugins’ settings, transmitting them to a remote server over HTTP.

Campaign details and discovery

• The malicious activity was identified as a coordinated effort on the JetBrains Marketplace.
• Fifteen IDE plugins share a common hidden payload designed to steal credentials you store in the plugin’s settings.
• The campaign began with first publications in October 2025 and showed new plugin releases as recently as June 10, 2026.
• Installations across all affected plugins total roughly 70,000, though download counts can be manipulated and may not reflect unique users.
• Aikido Security separately analyzed the latest version of a representative plugin and confirmed the presence of the credential theft logic.

How the theft works

• User interaction: The theft is triggered when a user enters an AI provider API key into the plugin’s settings and clicks Apply.
• Data exfiltration: The entered credential is sent to a hardcoded remote server via HTTP. The destination used in the observed samples is a specific IP address with a post endpoint designed to receive the key.
• Hidden functionality: All 15 plugins share similar code paths and covert routines that facilitate this data exfiltration, appearing legitimate while operating in the background.
• Post-payment leakage: The same infrastructure is described as capable of sending a valid API key to paid users after a small donation-like payment is processed, enabling those users to access AI services through a key not owned by the victim.

Plugins identified in the campaign

• DeepSeek Junit Test
• DeepSeek Git Commit
• DeepSeek FindBugs
• DeepSeek AI Chat
• DeepSeek Dev AI
• DeepSeek AI Coding
• AI FindBugs
• AI Git Commitor
• AI Coder Review
• DeepSeek Coder AI
• AI Coder Assistant
• DeepSeek Code Review
• CodeGPT AI Assistant
• DeepSeek AI Assist
• Coding Simple Tool

Notable details about the plugins

• The two most downloaded plugins from this set were DeepSeek AI Assist and CodeGPT AI Assistant, with downloads in the tens of thousands. It is important to note that download counts are not a definitive measure of unique users, as counts can be manipulated.
• The plugins marketed as AI tools (such as coding aids and reviews) were observed to function as advertised on the surface, while simultaneously harvesting credentials in the background.

Impact and risk considerations

• Credential exposure: Developers frequently store API keys in IDE plugins to simplify integration with external AI services. The theft of these keys raises the risk of unauthorized access to the user’s AI accounts and potential misuse of those keys.
• Unauthorized access to paid services: The reported capability to provide API keys to paid users implies a potential path for attackers to monetize stolen credentials, bypassing legitimate ownership and licensing controls.
• Broad exposure: With multiple plugins and seven vendor accounts involved, the attack surface spans a wide portion of the JetBrains Marketplace ecosystem, potentially affecting a large pool of developers across different projects and teams.

Evidence and independent verification

• Security researchers from Aikido Security publicly described the shared behavior across the fifteen plugins and provided indicators of compromise, including the consistent exfiltration pattern to a hardcoded server.
• BleepingComputer conducted its own investigation by downloading and examining the DeepSeek AI Assist plugin, confirming the presence of the credential theft code described by Aikido.
• The plugins in question remained accessible on the JetBrains Marketplace at the time of reporting.

Vendor response and ongoing status

• JetBrains was contacted for comment regarding these malicious plugins, but no public statement or remediation update had been issued at the time of reporting.
• The fact that affected plugins were still available highlights the importance of rapid identification, response, and remediation within platform marketplaces to protect developers and downstream users.

Technical notes and patterns

• Shared codebase: The 15 plugins exhibited a strikingly similar codebase and behavior, suggesting a coordinated development effort rather than isolated incidents.
• Capsule of deception: The plugins provided legitimate functionality, with covert data exfiltration concealed within settings where developers input AI keys.
• Remote key provisioning: The described mechanism includes a server-driven component that can distribute API keys to certain users, creating a mechanism for monetization that bypasses normal value-creation and licensing norms.

Context within the broader security landscape

• Credential theft via plugins and third-party extensions is a known risk vector, though credential-stealing through JetBrains Marketplace plugins is comparatively rare relative to other repositories.
• This incident underlines the need for defense-in-depth practices across development environments, including careful plugin vetting, monitoring of unusual data flows, and strict access controls around credentials stored in development tools.

Final observations

• The campaign illustrates how malicious actors can blend legitimate software functionality with covert credential theft, leveraging the trust placed in a popular marketplace to reach a broad audience of developers.
• The ongoing nature of the activity—new plugins appearing after the initial discovery and continued installations—suggests a persistent attempt to harvest AI API keys and potentially monetize those credentials.
• Independent verification by multiple security researchers strengthens the credibility of the findings and emphasizes the importance of proactive review and platform-level safeguards in plugin ecosystems.