Skip to content

Back to the catalog

Multiple JetBrains IDE plugins caught stealing AI keys
aikido.devwriteup

Multiple JetBrains IDE plugins caught stealing AI keys

Aikido Security identified 15 JetBrains IDE plugins (posing as DeepSeek-based AI coding assistants) published under 7 vendor accounts that silently exfiltrate the AI provider API key a user enters into settings, sending it in plaintext over HTTP to a hardcoded C2 server at 39.107.60[.]51. The plugins also run a paid tier where the attacker's server hands back an API key to paying users — likely reselling keys stolen from other victims — and together the plugins have racked up nearly 70,000 installs since October 2025, with new listings still appearing in 2026. The writeup includes decompiled Java snippets of the save()/getKey() exfiltration logic, the C2 IOC, and the full list of malicious plugin IDs and vendor accounts.

TL;DR 15 JetBrains Marketplace plugins (70K+ installs) covertly exfiltrate users' AI provider API keys to a hardcoded C2 server, then resell stolen keys to paying "customers."
Open original ↗
Document

What it is

A coordinated malware campaign on the JetBrains Marketplace: at least 15 plugins across seven vendor accounts, all posing as DeepSeek/LLM-based coding assistants (chat, commit messages, code review, bug finding, unit tests). They work as advertised but exfiltrate the AI provider API key you paste into settings. Earliest versions appeared end of October 2025; new ones were still shipping as of June 2026, with ~70,000 combined installs.

How it works

The theft fires inside the settings apply() handler — the instant you click Apply, with no prompt or consent. The save() method only acts on keys matching a specific shape: non-null, prefixed sk-, and exactly 51 characters long. Matching keys are wrapped in a SoftwareDto and POSTed to http://39.107.60[.]51/api/software/<name> over plain HTTP, authenticated with a hardcoded static header X-Api-Key: F48D2AA7CF341F782C1D, body serialized as JSON via Gson.

The plugin also runs a paid tier via a built-in donation wall. After payment, the server returns a key (check request → data.getApiKey()), and getKey() always prefers this server-supplied key over the user's own. Aikido's theory: the operator harvests keys from one set of victims and resells that stolen access to paying victims — collecting money on one side and free credentials on the other.

Preconditions / Affected

You must have installed one of the affected plugins and pasted a provider API key (OpenAI, SiliconFlow, DeepSeek) into its settings. Only keys matching the sk- prefix + 51-char length are exfiltrated. Plugins run unsandboxed with full IDE privileges. Named IDs include org.sm.yms.toolkit, com.json.simple.kit, org.bug.find.tools, org.translate.ai.simple, com.yy.test.ai.simple — the article's tail lists the rest.

What to do

  • Hunt for outbound connections to 39.107.60[.]51, especially POSTs to /api/software/ or requests bearing the header X-Api-Key: F48D2AA7CF341F782C1D.
  • If any listed plugin is installed, assume the pasted key is compromised: revoke and rotate it at the provider immediately.
  • Aikido users: filter the central feed on malware issues (surfaces as a 100/100 critical), and trigger a manual rescan rather than waiting for the nightly.
  • Treat IDE plugins as dependencies running with your privileges; avoid pasting long-lived secrets into unvetted tools.

Caveats

Real impact is hard to measure — the article notes download counts are easily inflated by vendors and the listings carry fake five-star reviews, so ~70,000 installs is not a reliable victim count. JetBrains does manually review plugins, but the malicious logic is small enough to slip past. The resale mechanism is Aikido's stated theory, not confirmed fact.

Organisations named here

  • 39.107.60.51

Technologies named here

  • DeepSeek Junit Test
  • Aikido
  • Aikido Device Protection
  • DeepSeek Git Commit
  • DeepSeek FindBugs
  • Aikido Safe Chain
  • DeepSeek AI Chat
  • DeepSeek Dev AI
  • DeepSeek AI Coding
  • AI FindBugs
  • AI Git Commitor
  • AI Coder Review
  • DeepSeek Coder AI
  • AI Coder Assistant
  • DeepSeek Code Review
  • CodeGPT AI Assistant
  • DeepSeek AI Assist
  • Coding Simple Tool
  • JetBrains Marketplace / JetBrains IDE plugin ecosystem
  • AI provider API keys
  • VS Code
  • DeepSeek
  • OpenAI

Techniques named here

  • Credential exfiltration via settings handler
  • Supply chain attack via IDE plugin marketplace
  • Fake reviews and inflated download counts
  • Stolen-credential resale via paid tier

Threat actors named here

  • Unnamed malware campaign
  • GlassWorm
  • CodePilot
  • StackSmith
  • CodeCrafter
  • CodeWeaver
  • JetCode
  • DailyCode
  • ZenCoder

Related in Supply Chain