JetBrains Marketplace Supply Chain Attack: 15 Malicious AI-Assistant Plugins Exfiltrate DeepSeek/OpenAI API Keys to 39.107.60.51 — Threadlinqs Intelligence
As of 2026-07-11, JetBrains Marketplace Supply Chain Attack: 15 Malicious AI-Assistant Plugins Exfiltrate DeepSeek/OpenAI API Keys to 39.107.60.51 is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1246 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Between October 2025 and June 2026, a coordinated threat actor published 15 malicious JetBrains IDE plugins under 7 distinct vendor accounts, masquerading as DeepSeek/OpenAI-powered coding assistants,
Security researchers at Aikido Security identified a supply-chain credential-theft campaign operating on the JetBrains Marketplace from October 2025 through June 2026. The threat actor(s) registered at least seven distinct vendor/publisher accounts (CodePilot, StackSmith, CodeCrafter, CodeWeaver, JetCode, DailyCode, ZenCoder) and published 15 plugins that presented themselves as functional AI-powered developer tools — chat assistants, Git commit-message generators, static-analysis/bug-finding utilities, code-review helpers, and unit-test generators built atop DeepSeek, OpenAI, and SiliconFlow APIs.
Each plugin worked exactly as advertised on the surface, which allowed the campaign to accumulate close to 70,000 cumulative installs and pass casual marketplace review and JetBrains' automated Plugin Verifier (a compatibility/API-surface checker, not a data-flow or malware scanner). The malicious logic was embedded inside each plugin's settings-persistence (`save()`) handler: when a user entered their AI provider API key into the plugin's configuration panel and clicked "Apply," the handler validated the key format (targeting OpenAI/DeepSeek-style secrets beginning with the `sk-` prefix and 51 characters long), silently persisted it locally as expected, and — in the same synchronous main-thread call, with no user-facing indication — issued a plaintext HTTP POST containing the harvested key to a hardcoded command-and-control endpoint at `39.107.60.51`, path `/api/software/`, authenticated with a static bearer-style token (`F48D2AA7CF341F782C1D`) baked into the plugin binary.
Because exfiltration rode over unencrypted HTTP rather than TLS, the traffic was also trivially interceptable by any on-path observer (corporate proxy, VPN concentrator, coffee-shop Wi-Fi), widening the exposure beyond the original operator. The two most-installed plugins, DeepSeek AI Assist (~27,700 installs) and CodeGPT AI Assistant (~25,500 installs), were both published in the campaign's final wave on 2026-06-09/10, suggesting the operators surged fresh, unflagged plugin IDs shortly before the campaign was exposed.
The attackers additionally built a monetization loop around the stolen credentials: the plugins presented a "donation wall"/paid tier, and users who paid a small fee received a working API key pushed back down from the attacker's server — meaning the plugin then silently used a victim's stolen key on the paying customer's behalf, functioning as an underground AI-compute resale service laundered through other victims' credentials. Researchers describe this as a closed-loop economy: harvest free-tier victims' keys, monetize compute access to paying customers, and treat surplus stolen keys as an underground commodity.
JetBrains responded on 2026-06-17 by removing all 15 plugins from the Marketplace, blocking all seven implicated publisher accounts, and remotely disabling the plugins in IDE installations that had already installed them via backend kill-switch mechanisms. JetBrains also stated it was hardening its automated vetting pipeline to flag plugin code paths that resemble handling of cloud/AI API key material. As of 2026-06-19, the C2 infrastructure at 39.107.60.51 remained live and reachable, indicating the operators had not yet lost their exfiltration endpoint even after the Marketplace takedown.
The same reporting period surfaced a second, related-but-distinct campaign ("PromptSnatcher") involving two Chrome extensions masquerading as ad blockers (Smart Adblocker, ~90,000 users; Adblock for Browser, ~10,000 users) that intercepted AI chatbot conversations, model-usage metadata, and subscription-tier information across eight platforms (ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) while functioning as legitimate ad blockers using real filter lists (EasyList, IDCAC). This is tracked here as related context for the broader 2026 wave of AI-credential/conversation-harvesting supply-chain attacks targeting developer a
Weaknesses (CWE)
CWE-522, CWE-319, CWE-506
Target sectors: technology, softwaredevelopment, informationtechnology
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1585, T1583.004, T1587.001, T1608.001, T1195.002, T1199, T1204.002, T1505, T1036.005, T1027