15 JetBrains Marketplace Plugins Found Stealing Developers’ AI API Keys
Summary
Aikido Security says at least 15 JetBrains Marketplace plugins stole developers’ AI API keys and were installed nearly 70,000 times. BleepingComputer independently confirmed theft code in one plugin, which remained available at publication.
Key points
- Aikido Security linked at least 15 plugins, published under seven vendor accounts, to a coordinated credential-stealing campaign.
- The plugins posed as AI assistants, code-review tools, and Git utilities; the two most downloaded were DeepSeek AI Assist and CodeGPT AI Assistant.
- According to the researchers, keys entered in plugin settings were sent to a hardcoded server over HTTP after users clicked “Apply.”
- Aikido reported that the plugins also offered a paid tier in which the server supplied an AI API key; the researchers theorized that keys from free users might be reused.
- BleepingComputer said it independently confirmed credential-theft code in DeepSeek AI Assist, which remained available on the marketplace at publication.
- The plugins had nearly 70,000 reported installs, though researchers cautioned that download counts may be manipulated and may not represent unique users.
Article Details
- Event Type
- Coordinated campaign of malicious JetBrains Marketplace plugins stealing developers’ AI provider API keys.
- Impact
- At least 15 plugins reportedly sent API keys entered in their settings to a hardcoded server over HTTP after users clicked Apply. The plugins had been installed close to 70,000 times, though Aikido cautioned that download counts may be manipulated and may not represent unique installations. Aikido also reported that the server could provide API keys to paid users, and theorized that keys may have been harvested from free users; the source says this origin is unclear.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 39[.]107[.]60[.]51 | Hardcoded server reported as the destination for exfiltrated AI provider API keys. |
| URL | hxxp[:]//39[.]107[.]60[.]51/api/software/key | Hardcoded URL used by the malicious plugins to send users’ AI provider API keys to the attackers over HTTP. |
Vendors
DeepSeekThe plugins have been installed nearly 70,000 times and include items such as DeepSeek AI Assist and CodeGPT AI Assistant, with stolen keys sent to a hardcoded server.JetBrainsAikido Security uncovered a coordinated campaign on the JetBrains Marketplace in which at least 15 plugins posed as AI coding and development tools while secretly stealing developers’ AI provider API keys.OpenAIThe campaign, discovered by Aikido Security, includes plugins that act as AI coding assistants, code-review tools, and Git utilities powered by popular AI services such as OpenAI, DeepSeek, and SiliconFlow.SiliconFlowThe campaign, discovered by Aikido Security, includes plugins that act as AI coding assistants, code-review tools, and Git utilities powered by popular AI services such as OpenAI, DeepSeek, and SiliconFlow.
Products
CodeGPT AI AssistantThe plugins have been installed nearly 70,000 times and include items such as DeepSeek AI Assist and CodeGPT AI Assistant, with stolen keys sent to a hardcoded server.DeepSeek AI AssistThe plugins have been installed nearly 70,000 times and include items such as DeepSeek AI Assist and CodeGPT AI Assistant, with stolen keys sent to a hardcoded server.JetBrains MarketplaceAikido Security uncovered a coordinated campaign on the JetBrains Marketplace in which at least 15 plugins posed as AI coding and development tools while secretly stealing developers’ AI provider API keys.