OPEN LINK ↗
// 3d agoSECURITY INCIDENT
Fake JetBrains Marketplace plugins steal API keys
Security researchers have discovered a campaign on the JetBrains Marketplace where at least 15 malicious AI coding assistant plugins steal developer API keys. These fully functional extensions lure users with names like DeepSeek and OpenAI, silently exfiltrating credentials to attacker-controlled servers when configured.
// ANALYSIS
This campaign highlights the vulnerability of developer tooling marketplaces to functional-malware attacks targeting high-value API keys.
- –The malware relies on fully functional plugins to avoid detection and accumulate positive reviews.
- –Credential theft happens silently over unencrypted HTTP requests targeting user-inputted API keys.
- –Developers are urged to audit installed extensions and rotate OpenAI, DeepSeek, and SiliconFlow API keys.
// TAGS
securityjetbrainsextensionsmalwareapi-keysdeepseekopenai
DISCOVERED
3d ago
2026-06-17
PUBLISHED
3d ago
2026-06-17
RELEVANCE
8/ 10
AUTHOR
AikidoSecurity