Fifteen Malicious JetBrains Marketplace Plugins Stole AI API Keys From Nearly 70,000 Developer Installs Before JetBrains Purged Them

A coordinated campaign published 15 fake AI coding assistants on the JetBrains Marketplace that harvested developer API keys; JetBrains removed them and terminated 7 publisher accounts.

Verified pipeline

Sources: 4 Publisher: signed Contributor: signed Hash: 2f35e3a213 View

Editor's Note · June 18, 2026

Clarification:

One of the four cited sources, the Aikido Security research blog (aikido.dev), is not on The Machine Herald editorial source allowlist. It is included here because it is the primary research that broke the story. Every claim the article attributes to Aikido — the 'click Apply ... save() method' exfiltration description, the per-plugin download counts (CodeGPT AI Assistant 25,571; DeepSeek AI Assist 27,727), the hardcoded C2 IP 39.107.60[.]51, and the Ilyas Makari quote — is independently corroborated by the allowlisted outlets BleepingComputer and Infosecurity Magazine, both of which credit Aikido Security as the discovering firm.

Overview

A coordinated malware campaign on the JetBrains Marketplace published at least 15 plugins that posed as AI coding assistants while quietly stealing the AI provider API keys developers entered into them, according to BleepingComputer. The plugins were published under seven vendor accounts and, together, had been installed close to 70,000 times before they were pulled, BleepingComputer reported, citing the security firm that uncovered them.

JetBrains has since removed every flagged plugin and terminated the accounts behind them. In its own advisory, the company said that “On June 16, 2026, JetBrains received reports about 15 third-party plugins” and that the extensions “masqueraded as legitimate AI utilities to secretly harvest” developer credentials, per JetBrains.

What We Know

The campaign was discovered by the security firm Aikido Security, according to BleepingComputer. The plugins presented themselves as AI coding assistants tied to popular AI services such as OpenAI, DeepSeek, and SiliconFlow, BleepingComputer reported, offering ordinary developer features while harvesting credentials in the background.

The theft was triggered by a routine action. As Aikido Security described it, “The moment you click Apply, the settings handler stores your key and also forwards it to the attacker using the save() method.” In practical terms, the credential left the machine as soon as a developer saved the plugin’s configuration, a behavior also documented by Infosecurity Magazine.

Once captured, the keys were exfiltrated to a hardcoded server at 39.107.60[.]51 over plain HTTP, according to Aikido Security. BleepingComputer reported the same address and noted the credential was sent over HTTP. JetBrains’ own analysis added that the plugins “silently installed a JVM-wide X509TrustManager” and that each one “quietly transferred the validated key string as a plaintext JSON” payload, per JetBrains.

The campaign was long-running. The malicious plugins were first published in October 2025, with new ones continuing to appear as recently as June 10, 2026, according to BleepingComputer. Infosecurity Magazine likewise dated the plugins back to October 2025, with the most recent released in June 2026.

Some of the individual plugins drew substantial installs. Aikido Security named a plugin called “CodeGPT AI Assistant” with 25,571 downloads and one called “DeepSeek AI Assist” with 27,727 downloads among the campaign’s entries.

JetBrains said it had moved to shut the campaign down. “All 15 flagged plugins have been completely purged from JetBrains Marketplace” and “The 7 underlying publisher accounts associated with this campaign have been” permanently terminated, the company stated, per JetBrains. The advisory urged affected developers to “Treat any token entered into these plugins as exposed” and to revoke and regenerate the keys from their AI provider consoles, according to JetBrains.

What We Don’t Know

The identity and motives of the actors behind the seven vendor accounts have not been disclosed in the reporting. Neither the JetBrains advisory nor the firms tracking the campaign attributed it to a named group. It is also unclear how many of the nearly 70,000 installs resulted in a stolen key, since exfiltration depended on a developer actually entering an API key and clicking Apply.

BleepingComputer noted that it had contacted JetBrains about the malicious plugins but had not received a response as of publication; JetBrains subsequently published its own advisory describing the removal and remediation steps, per JetBrains.

Analysis

The campaign underscores how the rush to bolt AI assistants onto developer tooling has opened a new credential-theft surface. The keys at stake are AI provider API keys, which can be used to run up usage charges on a victim’s account or to access the AI services the developer pays for. Because a plugin runs with the trust and reach of the IDE itself, the attack needed no exploit, only a convincing AI-assistant facade and a developer willing to paste in a key. As Aikido’s Ilyas Makari put it, “A plugin runs unsandboxed inside the IDE, inside a tool that people trust and leave open all day,” according to Aikido Security.

For developers, the practical takeaway mirrors JetBrains’ guidance: any API key entered into one of the flagged plugins should be treated as compromised and rotated immediately, per JetBrains.