“Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests,” Aikido Security warned in its report on a coordinated campaign that has quietly preyed on developers.
Malicious plugins found on the JetBrains Marketplace
Security researchers at Aikido Security identified at least 15 integrated development environment (IDE) plugins on the JetBrains Marketplace that contain code designed to steal developers’ AI-provider API keys. The plugins have collectively been installed around 70,000 times and — Aikido says — slipped past the marketplace’s security checks. The earliest of the malicious packages dates back to October 2025, with new, similar plugins appearing as recently as June 2026.
The add-ons adopt user-facing names such as “DeepSeek Git Commit” and “AI Coder Review.” On their face they behave like legitimate AI coding assistants, providing features developers expect: chat, commit-message generation, code review, bug finding, and unit test generation. That functionality, Aikido reports, is part of what allowed the plugins to remain live and continue collecting users.
How the plugins exfiltrate API keys
Aikido’s analysis describes a simple, immediate exfiltration flow embedded in each plugin’s settings panel. To operate, the plugins ask users to paste an API key for an AI provider — examples named by Aikido include OpenAI, SiliconFlow, and DeepSeek. Because the plugin must call the model on behalf of the user, entering a key appears routine.
But the moment the user clicks Apply, the settings handler stores the key locally and also forwards it to a server controlled by the attacker using the plugin’s save() method. Aikido notes the call “fires immediately on key entry, with no prompt, no consent screen, and no mention anywhere in the user interface.” In other words: the UI behaves normally while a concealed network call hands credentials to the operator.
Monetization hypothesis: reselling stolen API access
Aikido did not identify a single definitive end goal, but outlined two plausible commercial motivations. API keys that grant paid access to AI services can be used directly for compute, or they can be resold. Aikido leans toward resale as the likely model in this campaign because the malicious plugins include a paid tier.
According to the report, the plugins implement a small payment via a built-in donation wall; after payment, the user apparently receives an API key from the operator’s server to make “free” calls to the model. Aikido hypothesizes those server-supplied keys could be credentials exfiltrated from victims — transforming the campaign into a service that resells stolen API access. “The operator collects money on one side and free credentials on the other, while the genuine key owners pay the bill,” Aikido wrote.
Why IDEs are a valuable target
Aikido highlighted several structural reasons developers’ toolchains are attractive to attackers. IDEs are typically trusted by users and left open all day, which provides a persistent execution environment for malicious code. More critically, IDEs often have access to a developer’s workspace, including source code, cloud credentials, signing keys, and API keys — all of which are valuable to an operator who gains silent access.
What this means for developers, marketplace operators, and attackers
- Developers and security teams: Be aware that plugins may request provider API keys for services such as OpenAI, SiliconFlow, and DeepSeek; Aikido has shared indicators of compromise (IoCs) in its blog post, which the report recommends consulting to determine whether a given installation is affected.
- Marketplace operators and procurement leaders: These plugins evaded marketplace checks before widespread installation, spotlighting the risk that malicious code can be packaged inside otherwise functional tooling. The presence of paid tiers tied to server-provisioned API keys may warrant closer scrutiny of monetization flows.
- Adversaries and operators: The campaign illustrates a pragmatic criminal playbook: provide useful functionality to attract users, then convert stolen credentials into a revenue stream — either through resale of keys or by shifting usage costs to victims.
Aikido has published technical details and the IoCs accompanying its findings; its analysis frames the central questions that remain: who is operating the server-side infrastructure, and whether marketplace controls and developer practices will adapt quickly enough to stop credential siphoning. The original report is available from Infosecurity Magazine at the link below.
https://www.infosecurity-magazine.com/news/fifteen-jetbrains-marketplace/
