15 Malicious JetBrains Plugins Targeted AI API Keys Across About 70,000 Installs

Jun 18, 2026 · Original article ↗

Summary

StepSecurity reports that 15 JetBrains Marketplace plugins with about 70,000 installs captured AI API keys and sent them over plaintext HTTP to a hardcoded C2. JetBrains removed the plugins; StepSecurity found the server still responding on June 19, 2026.

Key points

The plugins presented themselves as AI-powered developer tools. StepSecurity’s analysis says they intercepted API keys when users saved plugin settings and sent new keys in JSON over HTTP POST.
The code reportedly checked for OpenAI-format keys with an sk- prefix and a length of 51 characters before sending them to the C2 at 39.107.60.51.
The analysis describes a custom JVM-wide X509TrustManager that suppressed TLS certificate-validation warnings.
The 15 plugins were published under seven vendor accounts and accumulated roughly 70,000 installs; the two newest reportedly accounted for more than 53,000 downloads.
JetBrains removed the plugins, banned the seven publisher accounts, and triggered a remote kill-switch on June 17, 2026. It said its internal systems, source code, and corporate infrastructure were not compromised.
StepSecurity reported that the C2 server was still responding on June 19, 2026, including at the reported API endpoints.
The article advises potentially affected users to remove the plugins, rotate API keys entered into them, review provider usage and billing, and check network logs for connections to the C2.

Article Details

Attack Vectors: Fifteen malicious third-party JetBrains Marketplace plugins masqueraded as AI-powered developer tools and were published through seven publisher accounts.
When a user entered an AI provider API key and clicked Apply, the plugin intercepted the key, checked for an OpenAI-style format, and sent newly seen keys to a hardcoded C2 server.
Plugins transmitted stolen keys in JSON over unencrypted HTTP POST requests to the C2 server.
The plugins installed a JVM-wide X509TrustManager that suppressed standard TLS certificate validation warnings.
The C2 server reportedly returned working API keys to users who paid through the plugins’ donation-wall feature.
Defensive Notes: Check JetBrains IDEs for the 15 listed plugins and manually uninstall them; JetBrains removed them from the Marketplace and triggered a remote kill-switch.
Revoke and rotate any AI provider API keys entered into the affected plugins, including keys for OpenAI, DeepSeek, and SiliconFlow.
Block 39.107.60[.]51 and review firewall, proxy, and endpoint logs for IDE-originated outbound HTTP or POST requests to /api/software/*.
Review AI provider usage, access logs, and billing for unfamiliar activity or unexpected consumption.
Scan repositories for exposed credentials with secrets-scanning tools and use tightly scoped API tokens and spending caps.

Indicators of compromise

Type	Indicator	Context
IPV4	`39[.]107[.]60[.]51`	Hardcoded attacker C2 server used to receive stolen AI API keys.
URL	`hxxp[:]//39[.]107[.]60[.]51/api/software/check`	Active C2 validation endpoint used by the malicious plugins.
URL	`hxxp[:]//39[.]107[.]60[.]51/api/software/key`	C2 HTTP POST endpoint identified as receiving exfiltrated API keys.