Skip to content

Back to the catalog

Malicious JetBrains Marketplace plugins steal AI API keys from developers
bleepingcomputer.comarticle

Malicious JetBrains Marketplace plugins steal AI API keys from developers

Aikido Security uncovered at least 15 JetBrains Marketplace plugins, published under seven vendor accounts since October 2025, that pose as AI coding assistants (DeepSeek, OpenAI, SiliconFlow-branded) but exfiltrate any AI provider API key a user enters into the plugin settings to a hardcoded server (39.107.60[.]51) over plain HTTP. The plugins also run a "paid tier" that hands back API keys the operators appear to be harvesting from other free-tier victims. BleepingComputer confirmed the DeepSeek AI Assist plugin still contains the theft code and remains downloadable; combined installs across the campaign approach 70,000.

TL;DR 15 malicious JetBrains Marketplace "AI assistant" plugins found by Aikido Security steal users' AI API keys to a hardcoded C2 server, ~70,000 installs.
Open original ↗
Document

What it is

A coordinated campaign of at least 15 malicious JetBrains Marketplace plugins that steal AI provider API keys. The summary names the actor (Aikido Security), the IOC server, and the ~70,000 install total. What it does not carry is the list you need to hunt for these in your own IDE fleet, the exact exfil endpoint, and the trigger.

How it works

The theft fires when a user clicks Apply after entering an API key in the plugin settings. The credential is POSTed to a hardcoded server over plain HTTP at:

hxxp://39.107.60[.]51/api/software/key

All 15 plugins share the same code submitted under different Marketplace listings across seven vendor accounts. Publishing ran from October 2025 through as recently as June 10, 2026.

Affected — plugin IDs to hunt for

The distinct thing the summary omits: the identifiers. Check installed IntelliJ-family plugins against these:

  • DeepSeek Junit Test (org.sm.yms.toolkit)
  • DeepSeek Git Commit (com.json.simple.kit)
  • DeepSeek FindBugs (org.bug.find.tools)
  • DeepSeek AI Chat (org.translate.ai.simple)
  • DeepSeek Dev AI (com.yy.test.ai.simple)
  • DeepSeek AI Coding (com.dev.ai.toolkit)
  • AI FindBugs (com.json.view.simple)
  • AI Git Commitor (com.my.git.ai.kit)
  • AI Coder Review (org.check.ai.ds)
  • DeepSeek Coder AI (com.review.tool.code)
  • AI Coder Assistant (org.code.assist.dev.tool)
  • DeepSeek Code Review (com.coder.ai.dpt)
  • CodeGPT AI Assistant (com.my.code.tools)
  • DeepSeek AI Assist (ord.cp.code.ai.kit)
  • Coding Simple Tool (com.dp.git.ai.tool)

The two largest are DeepSeek AI Assist (27,727) and CodeGPT AI Assistant (25,571) — but Aikido warns download counts can be inflated and are not unique-install proxies.

What to do

Uninstall any of the above. If a key was entered into one, rotate that AI provider API key immediately — it was transmitted in cleartext. Block/alert on outbound traffic to 39.107.60[.]51, especially the /api/software/key path. Note that the paid tier feeds attacker-supplied keys back to victims: if a plugin is silently making model calls on a key you never configured, assume you are consuming credentials harvested from other victims.

Caveats

BleepingComputer independently confirmed DeepSeek AI Assist (ord.cp.code.ai.kit) still contained the theft code and remained downloadable at publication; JetBrains had not responded. The origin of the keys handed to paid users is Aikido's theory, not confirmed.

Organisations named here

  • 39.107.60.51

Technologies named here

  • Aikido Security
  • JetBrains Marketplace
  • DeepSeek Junit Test
  • DeepSeek Git Commit
  • DeepSeek FindBugs
  • DeepSeek AI Chat
  • DeepSeek Dev AI
  • DeepSeek AI Coding
  • AI FindBugs
  • AI Git Commitor
  • AI Coder Review
  • DeepSeek Coder AI
  • AI Coder Assistant
  • DeepSeek Code Review
  • CodeGPT AI Assistant
  • DeepSeek AI Assist
  • Coding Simple Tool
  • AI provider API keys
  • DeepSeek
  • OpenAI

Techniques named here

  • Credential exfiltration via IDE plugin settings
  • Trojanized/malicious marketplace plugins
  • Paid-tier key distribution

Threat actors named here

  • Unnamed campaign operators

Related in Supply Chain