Loading story…
A coordinated campaign on the JetBrains Marketplace used at least 15 malicious IDE plugins masquerading as AI coding assistants to steal developers’ API keys for services including OpenAI, DeepSeek, and SiliconFlow. Researchers said the extensions appeared legitimate and functional, but silently exfiltrated credentials entered by users to attacker-controlled infrastructure, turning trusted development tools into a credential-harvesting channel.
The plugins were reportedly installed about 70,000 times and were active from at least October 2025 through June 2026. Investigators linked the operation to fake assistant-style extensions and said the actor may have monetized the theft by reselling stolen API access; some plugins allegedly included a paid tier that appeared to return API keys sourced from other victims, suggesting the campaign blended credential theft with a marketplace for illicit API access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Aikido Security disclosed that multiple JetBrains Marketplace plugins were stealing AI-related API keys from developers and published indicators of compromise for the campaign. The researchers said the plugins appeared functional but silently forwarded entered keys to attacker-controlled infrastructure.
According to Aikido Security, the campaign remained active through June 2026, with the most recent identified malicious JetBrains Marketplace plugins released that month. In total, at least 15 plugins were identified and had accumulated about 70,000 installs.
Aikido Security reported that the earliest identified plugins in the campaign dated back to October 2025. These plugins impersonated AI coding assistants while later being found to exfiltrate developers' AI-service API keys.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated supply-chain campaign on the JetBrains Marketplace used at least 15 malicious IDE plugins, published under seven vendor accounts, to steal developers’ API keys for AI services including **OpenAI**, **DeepSeek**, and **SiliconFlow**. Aikido Security said the plugins were disguised as AI coding assistants, code-review tools, and Git utilities, appeared functional, and were boosted with fake five-star reviews. The malicious extensions were first published in October 2025 and continued appearing through June 10, 2026, with combined installs reported at nearly 70,000. Researchers found the plugins intercepted credentials entered by users and exfiltrated them in plaintext over unencrypted HTTP to a hardcoded server at `39.107.60[.]51`, typically when developers saved settings in their IDE. Independent analysis of the **DeepSeek AI Assist** plugin confirmed the credential-theft behavior was still present, and the plugin remained available on the marketplace at the time of reporting. Investigators also identified a paid-tier mechanism in which the server returned working API keys to paying users, raising concerns that credentials stolen from free users were being redistributed as part of the scheme.
Jun 29, 2026
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as **AI token jacking**. The activity has generated nearly **$1 million in fraudulent charges** before some victims detected the abuse, with malicious infrastructure in some cases driving **tens of millions of API calls per day**. Stolen credentials are being monetized directly and also funneled through gray-market **"transfer stations"** that resell access to legitimate AI services using compromised or discounted accounts. The stolen keys are being obtained through **phishing**, **infostealer malware**, exposed file shares, public code repositories, and poisoned software packages, including self-propagating `npm` packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Aug 19, 2026
Researchers reported a coordinated campaign dubbed **AiFrame** involving 30+ malicious Google Chrome extensions masquerading as AI assistants (impersonating tools like **ChatGPT**, **Claude**, **Gemini**, and **Grok**) that collectively reached roughly **260,000–300,000 installs**. The extensions were found to **steal credentials, API keys, email content/messages, and browsing data**, and multiple items remained available in the Chrome Web Store at the time of reporting. LayerX attributed the set to a single operation based on shared code structure, permissions, and common command-and-control infrastructure under **`tapnetic[.]pro`** (including subdomains such as `claude.tapnetic.pro`). The extensions typically did not implement AI features locally; instead, they rendered a **full-screen iframe** that loaded remote content, enabling operators to change UI/logic and add capabilities without publishing an extension update. Reported high-install examples included **Gemini AI Sidebar** (`fppbiomdkfbhgjjdmojlogeceejinadg`, removed after reaching ~80k users) and apparent re-uploads/new IDs such as **AI Sidebar** (`gghdfkafnhfpaooiolhncejnlgglhkhe`, ~70k users), plus **AI Assistant** (`nlhpidbjmmffhoogcennoiopekbiglbp`, ~60k users, noted as having a “Featured” badge).
Jun 29, 2026