JetBrains Marketplace Supply Chain Attack: 15 Malicious AI-Assistant Plugins Exfiltrate DeepSeek/OpenAI API Keys to 39.107.60.51
JetBrains Marketplace Supply Chain Attack (TL-2026-1246), also tracked as JetBrains AI Plugin Key Theft Campaign, is a high-severity supply-chain compromise, first published 2026-07-11. It has no confirmed attribution, affects JetBrains Marketplace (third-party plugin) DeepSeek AI Assist, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1246
- Threat ID
- TL-2026-1246
- Also known as
- JetBrains AI Plugin Key Theft Campaign, PromptSnatcher (related Chrome extension campaign)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, informationtechnology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Between October 2025 and June 2026, a coordinated threat actor published 15 malicious JetBrains IDE plugins under 7 distinct vendor accounts, masquerading as DeepSeek/OpenAI-powered coding assistants, code-review, commit-message, and bug-finding tools. The plugins covertly exfiltrated users' AI API keys (OpenAI, DeepSeek, SiliconFlow) via plaintext HTTP POST to attacker infrastructure at 39.107.60.51 the instant a key was saved in plugin settings, accumulating roughly 70,000 installs before JetBrains removed the plugins and blocked the publisher accounts on 2026-06-17.
How JetBrains Marketplace Supply Chain Attack works
Security researchers at Aikido Security identified a supply-chain credential-theft campaign operating on the JetBrains Marketplace from October 2025 through June 2026. The threat actor(s) registered at least seven distinct vendor/publisher accounts (CodePilot, StackSmith, CodeCrafter, CodeWeaver, JetCode, DailyCode, ZenCoder) and published 15 plugins that presented themselves as functional AI-powered developer tools — chat assistants, Git commit-message generators, static-analysis/bug-finding utilities, code-review helpers, and unit-test generators built atop DeepSeek, OpenAI, and SiliconFlow APIs.
Each plugin worked exactly as advertised on the surface, which allowed the campaign to accumulate close to 70,000 cumulative installs and pass casual marketplace review and JetBrains' automated Plugin Verifier (a compatibility/API-surface checker, not a data-flow or malware scanner). The malicious logic was embedded inside each plugin's settings-persistence (`save()`) handler: when a user entered their AI provider API key into the plugin's configuration panel and clicked "Apply," the handler validated the key format (targeting OpenAI/DeepSeek-style secrets beginning with the `sk-` prefix and 51 characters long), silently persisted it locally as expected, and — in the same synchronous main-thread call, with no user-facing indication — issued a plaintext HTTP POST containing the harvested key to a hardcoded command-and-control endpoint at `39.107.60.51`, path `/api/software/`, authenticated with a static bearer-style token (`F48D2AA7CF341F782C1D`) baked into the plugin binary.
Because exfiltration rode over unencrypted HTTP rather than TLS, the traffic was also trivially interceptable by any on-path observer (corporate proxy, VPN concentrator, coffee-shop Wi-Fi), widening the exposure beyond the original operator. The two most-installed plugins, DeepSeek AI Assist (~27,700 installs) and CodeGPT AI Assistant (~25,500 installs), were both published in the campaign's final wave on 2026-06-09/10, suggesting the operators surged fresh, unflagged plugin IDs shortly before the campaign was exposed.
The attackers additionally built a monetization loop around the stolen credentials: the plugins presented a "donation wall"/paid tier, and users who paid a small fee received a working API key pushed back down from the attacker's server — meaning the plugin then silently used a victim's stolen key on the paying customer's behalf, functioning as an underground AI-compute resale service laundered through other victims' credentials. Researchers describe this as a closed-loop economy: harvest free-tier victims' keys, monetize compute access to paying customers, and treat surplus stolen keys as an underground commodity.
JetBrains responded on 2026-06-17 by removing all 15 plugins from the Marketplace, blocking all seven implicated publisher accounts, and remotely disabling the plugins in IDE installations that had already installed them via backend kill-switch mechanisms. JetBrains also stated it was hardening its automated vetting pipeline to flag plugin code paths that resemble handling of cloud/AI API key material. As of 2026-06-19, the C2 infrastructure at 39.107.60.51 remained live and reachable, indicating the operators had not yet lost their exfiltration endpoint even after the Marketplace takedown.
The same reporting period surfaced a second, related-but-distinct campaign ("PromptSnatcher") involving two Chrome extensions masquerading as ad blockers (Smart Adblocker, ~90,000 users; Adblock for Browser, ~10,000 users) that intercepted AI chatbot conversations, model-usage metadata, and subscription-tier information across eight platforms (ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) while functioning as legitimate ad blockers using real filter lists (EasyList, IDCAC). This is tracked here as related context for the broader 2026 wave of AI-credential/conversation-harvesting supply-chain attacks targeting developer and AI-consumer tooling, not as the same intrusion set.
MITRE ATT&CK techniques used in TL-2026-1246
Collection
T1005 Data from Local System; T1602 Data from Configuration Repository
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
T1071.001 Web Protocols; T1571 Non-Standard Port
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Execution
Impact
Persistence
T1505 Server Software Component
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files
Resource Development
T1583.004 Server; T1585 Establish Accounts; T1587.001 Malware; T1608.001 Upload Malware
Affected products and versions in JetBrains Marketplace Supply Chain Attack
- JetBrains Marketplace (third-party plugin) — DeepSeek AI Assist
Vulnerable versions: all versions, plugin ID ord.cp.code.ai.kit
Fixed in: removed from Marketplace 2026-06-17 - JetBrains Marketplace (third-party plugin) — CodeGPT AI Assistant
Vulnerable versions: all versions, plugin ID com.my.code.tools
Fixed in: removed from Marketplace 2026-06-17 - JetBrains Marketplace (third-party plugin) — DeepSeek Coder AI
Vulnerable versions: all versions, plugin ID com.review.tool.code
Fixed in: removed from Marketplace 2026-06-17 - JetBrains Marketplace (third-party plugin) — Other 12 plugins (DeepSeek Junit Test, DeepSeek Git Commit, DeepSeek FindBugs, DeepSeek AI Chat, DeepSeek Dev AI, DeepSeek AI Coding, AI FindBugs, AI Git Commitor, AI Coder Review, AI Coder Assistant, DeepSeek Code Review, Coding Simple Tool)
Vulnerable versions: all versions
Fixed in: removed from Marketplace 2026-06-17 - Google Chrome Web Store (related campaign) — Smart Adblocker / Adblock for Browser
Vulnerable versions: all versions
Fixed in: unknown/not confirmed removed as of report date
Remediation for JetBrains Marketplace Supply Chain Attack
Patches
- No vendor patch applicable — remediation is plugin removal, key rotation, and marketplace takedown rather than a software fix.
Immediate actions
- Uninstall any of the 15 named plugins from all JetBrains IDE installations immediately.
- Revoke and rotate any OpenAI, DeepSeek, or SiliconFlow API keys ever entered into an affected plugin's settings panel.
- Review AI provider billing/usage dashboards for anomalous usage from unrecognized IPs indicating the key was reused by attackers.
- Block outbound network traffic to 39.107.60.51 and the /api/software/ endpoint at network egress and endpoint firewall.
- Uninstall the 'Smart Adblocker' and 'Adblock for Browser' Chrome extensions if present, and rotate credentials/session tokens for any AI chat platform accounts used while the extensions were active.
Workarounds
- Never store or paste production/paid-tier AI API keys into third-party IDE or browser plugin configuration panels; use environment variables or secrets managers consumed directly by first-party SDKs instead.
Longer-term hardening
- Restrict IDE plugin installation to an internally vetted allowlist for developer fleets, especially plugins requesting network access.
- Deploy egress-filtering/DLP rules that flag API-key-shaped strings (e.g., sk- prefixed, 40-60 char secrets) leaving developer endpoints over plaintext HTTP.
- Treat IDE/browser plugin marketplaces as untrusted software supply chains requiring the same review rigor as third-party dependencies (SBOM, code review, network behavior analysis).
- Prefer API providers and integration patterns that support key scoping, short TTL/session tokens, or client certificates over long-lived static API keys embedded in third-party tools.
Weaknesses (CWE) in JetBrains Marketplace Supply Chain Attack
CWE-522, CWE-319, CWE-506
Timeline of JetBrains Marketplace Supply Chain Attack
- First malicious plugin in the campaign, 'DeepSeek Junit Test' (org.sm.yms.toolkit), published on JetBrains Marketplace.
- 'DeepSeek Git Commit' (com.json.simple.kit) published, beginning a steady cadence of new malicious plugin releases through publisher account 'CodePilot' and affiliated accounts.
- 'DeepSeek Coder AI' (com.review.tool.code) published; would go on to accumulate 3,498 downloads, one of the higher-volume plugins in the campaign.
- 'DeepSeek Code Review' (com.coder.ai.dpt) published, continuing the campaign into its final wave.
- 'CodeGPT AI Assistant' (com.my.code.tools) published; became the campaign's second-highest-volume plugin with 25,571 downloads.
- 'DeepSeek AI Assist' (ord.cp.code.ai.kit) published; became the campaign's highest-volume plugin with 27,727 downloads.
- JetBrains removed all 15 identified malicious plugins from the Marketplace, blocked the seven implicated publisher accounts, and remotely disabled the plugins in already-installed IDE instances following disclosure by Aikido Security.
- Researchers confirmed the command-and-control server at 39.107.60.51 remained live and reachable despite the Marketplace takedown, indicating the operators retained their exfiltration infrastructure.
- NSFOCUS Global published a consolidated technical case study analyzing the campaign's key-theft mechanism and C2 infrastructure.
Sources cited for JetBrains Marketplace Supply Chain Attack
- AI Security Incident Case: JetBrains Plugin Supply Chain Attack Stealing AI Key
- Multiple JetBrains IDE plugins caught stealing AI keys
- Malicious JetBrains Marketplace plugins steal AI API keys from developers
- Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats
- Fifteen JetBrains Marketplace Plugins Steal API Keys
- Malicious JetBrains Plugins Are a Developer Supply Chain Problem
- 15 JetBrains Plugins Stole AI API Keys — 70,000 Installs
- Malicious JetBrains and VS Code Extensions Steal OpenAI, Anthropic, and DeepSeek API Keys
- 15 Malicious JetBrains Plugins Caught Stealing DeepSeek, OpenAI API Keys
- Malicious JetBrains and VS Code Extensions Steal OpenAI, Anthropic, and DeepSeek API Keys
More in supply chain
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)
- indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()
- GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign
- Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
- PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting
Detection coverage for TL-2026-1246
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1246 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.