For developers who trust integrated development environment marketplaces as curated, safe ecosystems, a recently uncovered campaign delivers a sobering reality check. Security researchers have identified at least fifteen malicious plugins distributed through the JetBrains Marketplace — all engineered with a singular, covert purpose: stealing the AI API keys that developers store inside their IDEs.
The campaign, active since at least October 2025 and still producing new entries as of early June 2026, represents a calculated, patient operation targeting one of the most sensitive credentials a modern developer possesses. AI API keys grant direct access to costly, consumption-billed services — making them prime targets for financial fraud, resource abuse, and downstream supply chain compromise.
How the Attack Works
The plugins present themselves as legitimate productivity tools — AI coding assistants, automated code reviewers, Git commit utilities, and bug-finding integrations branded around popular large language model providers. To the average developer, they appear fully functional. They install cleanly, render a usable interface, and perform the advertised tasks. The deception is precisely the point.
The theft mechanism is surgical in its simplicity. When a user enters an AI provider API key into the plugin's settings panel and clicks "Apply," the credential is silently transmitted over unencrypted HTTP to a hardcoded command-and-control server. The exfiltration endpoint is consistent across all fifteen plugins — a detail that exposes the shared codebase underlying what was presented as a diverse vendor ecosystem spanning seven separate Marketplace accounts.
The plugins function exactly as advertised — right up until the moment they quietly hand your credentials to an attacker-controlled server over plain HTTP.
The coordinated nature of this campaign is underscored by the structural uniformity researchers discovered. Despite being published under different vendor identities with distinct plugin names, the underlying credential-harvesting logic is essentially identical across all fifteen packages. This level of coordination suggests a single threat actor or tightly organized group operating a multi-persona distribution strategy to maximize reach while evading pattern-based detection.
A Monetization Model Built on Stolen Credentials
Perhaps the most striking element of this campaign is the embedded monetization scheme. Beyond simple credential theft, the plugins include a tiered access model. Free users unknowingly surrender their API keys upon configuration. Paying users — those who submit a small fee through a built-in donation interface — receive a working AI provider API key delivered from the attacker's server, which the plugin then uses to fulfill model requests.
The implication is deeply troubling: the operators appear to be harvesting credentials from unpaid victims and redistributing them as a commodity to paying customers. This transforms stolen developer credentials into the operational backbone of a shadow AI access brokerage — a remarkably brazen monetization loop running inside a trusted development tool.
No legitimate software operator hands end users unrestricted, live API keys to paid external services. The presence of this behavior alone should serve as a significant red flag for any developer who encounters similar functionality in third-party plugins.
Scale and Scope
Combined, the fifteen plugins accumulated close to 70,000 installs. The two highest-download entries — a DeepSeek AI assistance tool and a rebranded CodeGPT assistant — each surpassed 25,000 downloads individually. Researchers caution, however, that download figures on plugin marketplaces can be artificially inflated, meaning actual unique victim counts may differ significantly from reported numbers.
The affected plugin identifiers span a range of branding strategies: some lean into the DeepSeek name, others invoke generic AI utility framing, and at least one mimics the well-known CodeGPT brand. This naming diversity reflects a deliberate effort to capture developers searching for integrations with multiple AI providers including OpenAI and SiliconFlow, broadening the potential victim pool.
The Broader Marketplace Security Problem
While malicious package campaigns targeting npm, PyPI, and similar open registries have become almost routine news, incidents involving IDE plugin marketplaces carry a distinct threat profile. Developers tend to place elevated trust in these environments, often assuming a higher bar of vetting than general package repositories. That assumption creates a dangerous blind spot.
The JetBrains Marketplace serves a professional developer audience — the exact demographic most likely to hold active, high-value API keys for premium AI services. Targeting this population through their primary working environment is an efficient and psychologically astute attack vector. At the time of reporting, at least one of the identified plugins remained available for download, underscoring the lag between discovery and platform-level remediation.
What You Should Do
The developer toolchain has become a high-value target precisely because of the privileged access it holds. AI API keys are no longer trivial credentials — they represent real financial exposure and potential access to sensitive organizational data processed through LLM workflows. Treating them with the same rigor applied to cloud access tokens and production secrets is no longer optional; it is an operational necessity.
