Researchers from Aikido Security report that at least 15 malicious plugins are listed on the JetBrains Marketplace and are designed to steal AI API keys from developers. The plugins are presented as tools such as AI coding assistants that work with large language models, including offerings framed around chat features and development workflows like commit messages, code review, bug finding, and unit tests. According to the reporting, the campaign is coordinated, and the malicious behavior focuses on exfiltrating authentication material that developers use to access AI services. The Hacker News and Bleeping Computer both describe the same core issue: multiple plugins masquerade as legitimate AI-related IDE extensions, while actually capturing and attempting to transmit sensitive API credentials. The sources indicate that the number of identified malicious plugins is at least 15, though researchers may continue to expand the list.
Researchers find 15 malicious JetBrains Marketplace plugins stealing AI API keys
Researchers from Aikido Security report that at least 15 malicious plugins are listed on the JetBrains Marketplace and are designed to steal AI API keys from developers. The plugins are presented as t...
- Researchers identify at least 15 malicious plugins on the JetBrains Marketplace.
- The plugins pose as AI coding assistant tools for IDE workflows.
- The malicious behavior includes stealing or exfiltrating AI provider API keys from developers.
- Reports describe the activity as a coordinated malware campaign.
- The plugins also mirror features such as chat and coding-related assistance (e.g., code review, tests).
Cybersecurity researchers have flagged a "coordinated malware campaign" on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys. "Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests,"
2 months agoAikido Security has discovered at least 15 IDE plugins on the JetBrains Marketplace
2 months agoAt least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. [...]
2 months ago
Meta agrees up to $16.7bn settlement to end US trial over alleged teen social media harms
Meta agrees to a multibillion-dollar settlement to end a landmark US legal case over claims that Facebook and Instagram...
Apple TV announces heist thriller “12 12 12” starring Anthony Mackie and Jamie Dornan
Apple TV releases details and a first teaser for the new crime thriller series “12 12 12,” starring Anthony Mackie and J...
Meta agrees to $18 billion settlement in U.S. lawsuits over harms to children
Meta agrees to pay $18 billion to settle U.S. lawsuits alleging that its social media platforms cause or contribute to h...