# JetBrains Marketplace Supply Chain Attack: 15 Malicious AI-Assistant Plugins Exfiltrate DeepSeek/OpenAI API Keys to 39.107.60.51

> Between October 2025 and June 2026, a coordinated threat actor published 15 malicious JetBrains IDE plugins under 7 distinct vendor accounts, masquerading as DeepSeek/OpenAI-powered coding assistants, code-review, commit-message, and bug-finding tools. The plugins covertly exfiltrated users' AI API keys (OpenAI, DeepSeek, SiliconFlow) via plaintext HTTP POST to attacker infrastructure at 39.107.60.51 the instant a key was saved in plugin settings, accumulating roughly 70,000 installs before JetBrains removed the plugins and blocked the publisher accounts on 2026-06-17.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1246
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jetbrains-ai-plugin-key-theft-tl-2026-1246.webp?v=61f43fd0 (Threadlinqs threat intel: JetBrains Marketplace AI Key Theft: Detection & IOCs (TL-2026-1246) — High severity, 28 IOCs, 9 detection rules.)
- **ID:** TL-2026-1246
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (1 shown free below)

## Description

Security researchers at Aikido Security identified a supply-chain credential-theft campaign operating on the JetBrains Marketplace from October 2025 through June 2026. The threat actor(s) registered at least seven distinct vendor/publisher accounts (CodePilot, StackSmith, CodeCrafter, CodeWeaver, JetCode, DailyCode, ZenCoder) and published 15 plugins that presented themselves as functional AI-powered developer tools — chat assistants, Git commit-message generators, static-analysis/bug-finding utilities, code-review helpers, and unit-test generators built atop DeepSeek, OpenAI, and SiliconFlow APIs.

Each plugin worked exactly as advertised on the surface, which allowed the campaign to accumulate close to 70,000 cumulative installs and pass casual marketplace review and JetBrains' automated Plugin Verifier (a compatibility/API-surface checker, not a data-flow or malware scanner). The malicious logic was embedded inside each plugin's settings-persistence (`save()`) handler: when a user entered their AI provider API key into the plugin's configuration panel and clicked "Apply," the handler validated the key format (targeting OpenAI/DeepSeek-style secrets beginning with the `sk-` prefix and 51 characters long), silently persisted it locally as expected, and — in the same synchronous main-thread call, with no user-facing indication — issued a plaintext HTTP POST containing the harvested key to a hardcoded command-and-control endpoint at `39.107.60.51`, path `/api/software/`, authenticated with a static bearer-style token (`F48D2AA7CF341F782C1D`) baked into the plugin binary.

Because exfiltration rode over unencrypted HTTP rather than TLS, the traffic was also trivially interceptable by any on-path observer (corporate proxy, VPN concentrator, coffee-shop Wi-Fi), widening the exposure beyond the original operator. The two most-installed plugins, DeepSeek AI Assist (~27,700 installs) and CodeGPT AI Assistant (~25,500 installs), were both published in the campaign's final wave on 2026-06-09/10, suggesting the operators surged fresh, unflagged plugin IDs shortly before the campaign was exposed.

The attackers additionally built a monetization loop around the stolen credentials: the plugins presented a "donation wall"/paid tier, and users who paid a small fee received a working API key pushed back down from the attacker's server — meaning the plugin then silently used a victim's stolen key on the paying customer's behalf, functioning as an underground AI-compute resale service laundered through other victims' credentials. Researchers describe this as a closed-loop economy: harvest free-tier victims' keys, monetize compute access to paying customers, and treat surplus stolen keys as an underground commodity.

JetBrains responded on 2026-06-17 by removing all 15 plugins from the Marketplace, blocking all seven implicated publisher accounts, and remotely disabling the plugins in IDE installations that had already installed them via backend kill-switch mechanisms. JetBrains also stated it was hardening its automated vetting pipeline to flag plugin code paths that resemble handling of cloud/AI API key material. As of 2026-06-19, the C2 infrastructure at 39.107.60.51 remained live and reachable, indicating the operators had not yet lost their exfiltration endpoint even after the Marketplace takedown.

The same reporting period surfaced a second, related-but-distinct campaign ("PromptSnatcher") involving two Chrome extensions masquerading as ad blockers (Smart Adblocker, ~90,000 users; Adblock for Browser, ~10,000 users) that intercepted AI chatbot conversations, model-usage metadata, and subscription-tier information across eight platforms (ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) while functioning as legitimate ad blockers using real filter lists (EasyList, IDCAC). This is tracked here as related context for the broader 2026 wave of AI-credential/conversation-harvesting supply-chain attacks targeting developer and AI-consumer tooling, not as the same intrusion set.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1583.004 Server
- T1587.001 Malware
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1505 Server Software Component
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1602 Data from Configuration Repository
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malicious JetBrains AI-Assistant Plugin Installation (Marketplace Supply Chain)** (`TL-2026-1246-SPL-001`)

Detects installation of one of the 15 known-malicious JetBrains plugin IDs from the DeepSeek/OpenAI API-key-theft campaign, evidenced by plugin-manager/idea.log entries referencing the plugin IDs or names being downloaded/enabled. Covers Initial Access via supply-chain compromise and masquerading as a legitimate AI coding assistant.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1199, T1036.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| regex TargetFilename="(?i)\\JetBrains\\.*\\(config|plugins)\\.*(ord\.cp\.code\.ai\.kit|com\.my\.code\.tools|com\.review\.tool\.code|org\.sm\.yms\.toolkit|com\.json\.simple\.kit|org\.bug\.find\.tools|org\.translate\.ai\.simple|com\.yy\.test\.ai\.simple|com\.dev\.ai\.toolkit|com\.json\.view\.simple|com\.my\.git\.ai\.kit|org\.check\.ai\.ds|org\.code\.assist\.dev\.tool|com\.coder\.ai\.dpt|com\.dp\.git\.ai\.tool)"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer, User, TargetFilename
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table Computer, User, TargetFilename, first_seen, last_seen, count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("JetBrains") and (FolderPath has_any ("config", "plugins"))
| where FolderPath has_any ("ord.cp.code.ai.kit","com.my.code.tools","com.review.tool.code","org.sm.yms.toolkit","com.json.simple.kit","org.bug.find.tools","org.translate.ai.simple","com.yy.test.ai.simple","com.dev.ai.toolkit","com.json.view.simple","com.my.git.ai.kit","org.check.ai.ds","org.code.assist.dev.tool","com.coder.ai.dpt","com.dp.git.ai.tool")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count() by DeviceName, InitiatingProcessAccountName, FolderPath
```

### Sigma

```yaml
title: Malicious JetBrains AI-Assistant Plugin Installation
id: 6b3f2c10-9c47-4e2a-9d0e-1a2b3c4d5e6f
status: experimental
description: Detects install/enable of one of the 15 known-malicious JetBrains Marketplace plugin IDs from the DeepSeek/OpenAI API-key-theft supply-chain campaign
references:
    - https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1199
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - 'JetBrains'
        TargetFilename|contains|all:
            - 'plugins'
    plugin_ids:
        TargetFilename|contains:
            - 'ord.cp.code.ai.kit'
            - 'com.my.code.tools'
            - 'com.review.tool.code'
            - 'org.sm.yms.toolkit'
            - 'com.json.simple.kit'
            - 'org.bug.find.tools'
            - 'org.translate.ai.simple'
            - 'com.yy.test.ai.simple'
            - 'com.dev.ai.toolkit'
            - 'com.json.view.simple'
            - 'com.my.git.ai.kit'
            - 'org.check.ai.ds'
            - 'org.code.assist.dev.tool'
            - 'com.coder.ai.dpt'
            - 'com.dp.git.ai.tool'
    condition: selection and plugin_ids
falsepositives:
    - Security researchers deliberately downloading a sample for analysis
level: critical
```

**Known false positives:**

- Security researcher or IR analyst deliberately retrieving a known-malicious plugin artifact for analysis in an isolated sandbox

**Tuning notes:** Extend the plugin-ID list as JetBrains/Aikido disclose additional malicious IDs from this or related campaigns; correlate hits with EDR process-tree data for idea64.exe/pycharm64.exe to confirm the plugin directory belongs to an actively running IDE instance rather than a stale download.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- User-Executed IDE Launch Immediately Following Malicious Plugin Drop (locked: unlock with TL Creds)
- Application Access Token Theft via IDE Plugin Configuration Panel (locked: unlock with TL Creds)
- Static Bearer-Token Header Consistent with JetBrains Plugin C2 Campaign (locked: unlock with TL Creds)
- Trojanized AI-Coding-Assistant Plugin Masquerading via Verified Marketplace Listing (locked: unlock with TL Creds)
- Server Software Component Persistence via Remote Kill-Switch-Controlled Plugin (locked: unlock with TL Creds)
- Anomalous AI-Provider API Usage Following Unvetted IDE/Browser Plugin Install (Resource Hijacking) (locked: unlock with TL Creds)
- sk-Prefixed API Key Written to JetBrains Plugin Settings File (locked: unlock with TL Creds)
- Plaintext HTTP POST to JetBrains-Campaign C2 IP/Path ([indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 28)

Defanged, TLP:CLEAR.

- IP address: `39.107.60[.]51`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AI Security Incident Case: JetBrains Plugin Supply Chain Attack Stealing AI Key](https://nsfocusglobal.com/ai-security-incident-case-jetbrains-plugin-supply-chain-attack-stealing-ai-key/)
- [Multiple JetBrains IDE plugins caught stealing AI keys](https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys)
- [Malicious JetBrains Marketplace plugins steal AI API keys from developers](https://www.bleepingcomputer.com/news/security/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers/)
- [Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats](https://thehackernews.com/2026/06/malicious-jetbrains-plugins-steal-ai.html)
- [Fifteen JetBrains Marketplace Plugins Steal API Keys](https://www.infosecurity-magazine.com/news/fifteen-jetbrains-marketplace/)
- [Malicious JetBrains Plugins Are a Developer Supply Chain Problem](https://www.penligent.ai/hackinglabs/malicious-jetbrains-plugins/)
- [15 JetBrains Plugins Stole AI API Keys — 70,000 Installs](https://byteiota.com/jetbrains-malicious-plugins-ai-keys-2026/)
- [Malicious JetBrains and VS Code Extensions Steal OpenAI, Anthropic, and DeepSeek API Keys](https://cybersecuritynews.com/malicious-jetbrains-and-vs-code-extensions-steal-api-keys/)
- [15 Malicious JetBrains Plugins Caught Stealing DeepSeek, OpenAI API Keys](https://hackread.com/malicious-jetbrains-plugins-steal-deepseek-openai-api-keys/)
- [Malicious JetBrains and VS Code Extensions Steal OpenAI, Anthropic, and DeepSeek API Keys](https://www.cryptika.com/malicious-jetbrains-and-vs-code-extensions-steal-openai-anthropic-and-deepseek-api-keys/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1246