Summary
Security researchers at Aikido discovered a coordinated supply chain campaign involving 15 malicious plugins on the JetBrains Marketplace, all designed to steal AI provider API keys from developers. The plugins, published under seven fake vendor accounts, masqueraded as legitimate AI coding assistants with features like code review, commit message generation, and chat interfaces.
The campaign ran for approximately eight months — from October 2025 through June 2026 — accumulating roughly 70,000 installations before JetBrains removed them on June 16. When developers entered their API keys and clicked “Apply,” the credentials were silently exfiltrated over unencrypted HTTP to a hardcoded C2 server located in Beijing. Targeted services included OpenAI, Anthropic, Google AI, DeepSeek, and SiliconFlow.
Affected plugins used names mimicking popular tools: “DeepSeek AI Chat,” “CodeGPT AI Assistant,” “AI Coder Review,” and others. JetBrains has blocked the associated publisher accounts and remotely disabled the plugins in installed IDEs. Any developer who used these plugins before June 17, 2026, should treat their API keys as compromised and revoke them immediately.
Source
Commentary
Developer tooling supply chains are becoming the preferred hunting ground for credential harvesting, and this campaign is a textbook example. The attackers understood that AI API keys are the new high-value credential — they’re expensive, they’re often shared across teams, and they unlock access to models that can be weaponized for further attacks or resold for LLMjacking operations.
The 8-month dwell time before detection is concerning but not surprising. Plugin marketplaces still operate on a trust-first model, and most developers install IDE extensions without a second thought. The lesson: treat API key entry in any third-party plugin the same way you’d treat entering your password on an unfamiliar website. Verify the publisher, check the source, and rotate keys regularly.