Executive Summary
15 malicious JetBrains plugins posing as AI coding assistants stole AI provider keys, while Chrome extensions captured chatbot conversations.
What Happened
Cybersecurity researchers have flagged a "coordinated malware campaign" on the JetBrains Marketplace that has published no less than 15 malicious plugins capable of exfiltrating artificial intelligence (AI) provider keys. "Every plugin poses as an AI coding assistant built on DeepSeek and other large language models, offering chat, commit messages, code review, bug finding, and unit tests,"
Affected Products
- JetBrains Marketplace
- Chrome extensions
Vulnerability / Attack Technique
Fake AI assistant plugins stealing keys and chats
Technical Mechanism
Plugins exfiltrate configured API keys; extensions read chat pages.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
Fake AI tools target AI keys and conversations. RealGround analysis: allowlist IDE plugins and browser extensions.
Recommended Controls
- Remove unknown AI plugins
- Rotate AI provider keys
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/malicious-jetbrains-plugins-steal-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.