Loading story…
A coordinated supply-chain campaign on the JetBrains Marketplace used at least 15 malicious IDE plugins, published under seven vendor accounts, to steal developers’ API keys for AI services including OpenAI, DeepSeek, and SiliconFlow. Aikido Security said the plugins were disguised as AI coding assistants, code-review tools, and Git utilities, appeared functional, and were boosted with fake five-star reviews. The malicious extensions were first published in October 2025 and continued appearing through June 10, 2026, with combined installs reported at nearly 70,000.
Researchers found the plugins intercepted credentials entered by users and exfiltrated them in plaintext over unencrypted HTTP to a hardcoded server at 39.107.60[.]51, typically when developers saved settings in their IDE. Independent analysis of the DeepSeek AI Assist plugin confirmed the credential-theft behavior was still present, and the plugin remained available on the marketplace at the time of reporting. Investigators also identified a paid-tier mechanism in which the server returned working API keys to paying users, raising concerns that credentials stolen from free users were being redistributed as part of the scheme.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer independently analyzed the latest DeepSeek AI Assist plugin and confirmed it still contained credential-stealing functionality. The outlet also reported that the plugin remained available on the JetBrains Marketplace at the time of publication.
Aikido Security discovered a coordinated supply-chain attack involving 15 JetBrains plugins that exfiltrated API keys for services including OpenAI, DeepSeek, and SiliconFlow to attacker-controlled infrastructure over HTTP. Researchers also identified a paid-tier mechanism that appeared to redistribute working keys to paying users.
Aikido Security reported that new malicious plugins in the campaign continued appearing on the JetBrains Marketplace through June 10, 2026. Across 15 plugins from seven seller accounts, the campaign accumulated nearly 70,000 installs.
A coordinated campaign began publishing malicious JetBrains Marketplace plugins under multiple vendor accounts, disguising them as AI assistants, code-review tools, and Git utilities. The plugins were designed to steal developer-entered API keys.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
nsfocusglobal.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcexakep.ru
Open sourcelinuxsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated campaign on the JetBrains Marketplace used at least **15 malicious IDE plugins** masquerading as AI coding assistants to steal developers’ API keys for services including **OpenAI**, **DeepSeek**, and **SiliconFlow**. Researchers said the extensions appeared legitimate and functional, but silently exfiltrated credentials entered by users to attacker-controlled infrastructure, turning trusted development tools into a credential-harvesting channel. The plugins were reportedly installed about **70,000 times** and were active from at least **October 2025 through June 2026**. Investigators linked the operation to fake assistant-style extensions and said the actor may have monetized the theft by reselling stolen API access; some plugins allegedly included a paid tier that appeared to return API keys sourced from other victims, suggesting the campaign blended credential theft with a marketplace for illicit API access.
Aug 11, 2026
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as **AI token jacking**. The activity has generated nearly **$1 million in fraudulent charges** before some victims detected the abuse, with malicious infrastructure in some cases driving **tens of millions of API calls per day**. Stolen credentials are being monetized directly and also funneled through gray-market **"transfer stations"** that resell access to legitimate AI services using compromised or discounted accounts. The stolen keys are being obtained through **phishing**, **infostealer malware**, exposed file shares, public code repositories, and poisoned software packages, including self-propagating `npm` packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Aug 19, 2026
Researchers disclosed a supply-chain weakness in the ClawHub AI plugin registry after finding **23 unauthorized, code-executing plugins** published under official-looking scopes including `@openclaw/` and `@clawhub/`. Manifold Security reported that ClawHub did not consistently reserve those namespaces for legitimate owners across all existing packages, allowing unrelated accounts to publish plugins that appeared to be first-party tools for ClawHub, OpenClaw, and other agent ecosystems. The reviewed plugins were not confirmed to contain malicious code, but they still ran inside agent environments, creating a trust and impersonation risk for users who relied on scope names as proof of authenticity. Several of the exposed plugins carried **high-risk capabilities**, including payment processing, host-level Git execution, configuration export, and access to external APIs, underscoring the potential impact if a malicious actor abused the same gap. After disclosure, ClawHub unlisted all 23 plugins, changed registry handling, and added a dispute process for unauthorized namespace usage. The case highlights broader security gaps emerging in AI tool and plugin registries, where weak publication-time ownership checks can turn official branding cues into a software supply-chain attack surface.
Jun 29, 2026