Breaking

15 Fake AI Plugins on JetBrains Marketplace Steal Developer API Keys

June 16, 2026 at 17:56 EDT

Security
Software Dev & Coding

Security firm Aikido Security reported on June 16, 2026, that it had found at least 15 malicious IDE plugins on the JetBrains Marketplace that posed as AI coding assistants while stealing the AI API keys developers entered. Published from seven vendor accounts, they were installed roughly 70,000 times by download count.

JetBrains Marketplace · AI Key Theft

15 malicious plugins stole developers' AI API keys — ~70,000 downloads

Posing as tools like "DeepSeek AI Assist" and "CodeGPT AI Assistant," the plugins worked as advertised — but the moment a key was entered and saved, hidden code shipped it to an attacker's server over plain HTTP.

malicious plugins identified across 7 vendor accounts

~70k

combined downloads of the malicious plugins

character sk- keys exfiltrated instantly on "Apply"

Where the downloads concentrated

Two plugins alone exceeded 50,000 downloads

27,727

DeepSeek
AI Assist

25,571

CodeGPT
AI Assistant

3,498

DeepSeek
Coder AI

~13k

Other 12
plugins

How the theft worked

STEP 1

Developer enters AI key in settings & clicks "Apply"

→

STEP 2

Hidden code sends key over plain HTTP to attacker C2 server

→

STEP 3

Stolen keys likely resold — paid "donations" return a different key

Why the impact is severe

Leaked keys can trigger surging bills or account suspension.
Marketplace manual review can be slipped past by logic hidden in working code.
Download counts can be manipulated — not a reliable trust signal.
Verify the publisher and source before installing any AI-related plugin.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.