Skip to content

Back to the catalog

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers
stepsecurity.iowriteup

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

StepSecurity details a coordinated supply chain attack in which 15 fake AI-powered JetBrains plugins (published across 7 vendor accounts from October 2025 to June 2026) exfiltrated developer AI provider API keys in plaintext to a hardcoded Alibaba Cloud C2 server at 39.107.60.51. The plugins genuinely worked (code review, test generation, DeepSeek/OpenAI chat) but their save() methods intercepted valid-looking sk- API keys, disabled TLS certificate validation warnings JVM-wide, and POSTed the keys over unencrypted HTTP; a "donation wall" also resold stolen keys back to other victims. JetBrains banned the accounts and kill-switched the plugins on June 17, 2026, but StepSecurity confirmed the C2 server was still live two days later, and provides code snippets, network IOCs, and remediation/rotation steps.

TL;DR 15 malicious JetBrains Marketplace plugins stole 70,000 developers' AI API keys via plaintext HTTP exfiltration to a still-live Alibaba Cloud C2 server.
Open original ↗
Document

What it is

A supply-chain campaign on the JetBrains Marketplace: 15 malicious plugins across 7 vendor accounts, posing as DeepSeek/OpenAI-branded coding tools, that exfiltrated AI provider API keys to a C2 at 39.107.60.51 (Alibaba Cloud, Beijing). The summary covers the shape; the value here is the concrete hunting data — plugin package IDs, the exfil signature, and the timeline showing where the volume actually landed.

Preconditions / Affected

You are exposed only if a developer installed one of these plugins and entered an API key. Of ~70,000 installs, over 53,000 came from just the final two plugins published days before discovery (June 9–10, 2026): CodeGPT AI Assistant (com.my.code.tools, 25,571) and DeepSeek AI Assist (ord.cp.code.ai.kit, 27,727). Note the typo ord. — a useful tell. Full package IDs to hunt for include org.sm.yms.toolkit, com.json.simple.kit, org.bug.find.tools, org.translate.ai.simple, com.yy.test.ai.simple, com.dev.ai.toolkit, com.json.view.simple, com.my.git.ai.kit, org.check.ai.ds, com.review.tool.code, org.code.assist.dev.tool, com.coder.ai.dpt, com.my.code.tools, ord.cp.code.ai.kit.

How it works

Only sk--prefixed keys of exactly 51 characters (OpenAI format) were captured, on the "Apply" click via a save() hook. A seen.add(key) dedup check meant each key was sent once. Exfil was plaintext HTTP POST, Gson-serialized JSON, to http://39.107.60.51/api/software/<name>, carrying a hardcoded header:

X-Api-Key: F48D2AA7CF341F782C1D

A JVM-wide custom X509TrustManager suppressed TLS validation warnings to quiet local monitoring.

What to do

  • Hunt outbound connections to 39.107.60.51, and any HTTP request bearing X-Api-Key: F48D2AA7CF341F782C1D — this is a strong, unique IOC.
  • Rotate any OpenAI-format (sk-) API keys entered into JetBrains plugins during Oct 2025–Jun 2026. Deduplication means a key could have been stolen even if only entered once.
  • JetBrains removed all plugins, banned the accounts, and fired a remote kill-switch that disables the extensions on IDE relaunch — so relaunching the IDE neutralizes the running plugin, but does not revoke already-stolen keys.

Caveats

  • The C2 remained live and responsive on June 19, 2026, three days after removal — stolen keys are likely already in use; rotation is not optional.
  • StepSecurity notes it is unclear whether the 53,000 late-stage downloads are organic or inflated, so install counts may overstate real victim reach.
  • JetBrains confirmed no compromise of its own systems, source, or infrastructure — this is a marketplace-abuse attack, not a JetBrains breach.

Technologies named here

  • JetBrains Marketplace
  • StepSecurity Dev Machine Guard
  • DeepSeek Junit Test
  • git-secrets
  • TruffleHog
  • DeepSeek Git Commit
  • DeepSeek FindBugs
  • Gitleaks
  • Gson library
  • DeepSeek AI Chat
  • DeepSeek Dev AI
  • DeepSeek AI Coding
  • AI FindBugs
  • AI Git Commitor
  • AI Coder Review
  • DeepSeek Coder AI
  • AI Coder Assistant
  • DeepSeek Code Review
  • CodeGPT AI Assistant
  • DeepSeek AI Assist
  • JetBrains IDEs
  • OpenAI API keys
  • DeepSeek API keys
  • SiliconFlow API keys
  • DeepSeek
  • OpenAI
  • JetBrains

Techniques named here

  • Supply chain attack via malicious IDE plugins
  • Credential capture on input
  • TLS certificate validation suppression
  • Plaintext exfiltration over HTTP
  • Donation wall monetization scheme
  • Remote kill-switch

Threat actors named here

  • Unidentified attacker

Related in Supply Chain