A coordinated campaign on the JetBrains Marketplace has deployed 15 malicious plugins that function as advertised AI coding assistants while quietly siphoning API keys to an attacker-controlled server. Researchers at Aikido Security identified the plugins, which pose as DeepSeek-based tools offering chat, commit messages, code review, and unit tests. Since late October 2025, with updates as recent as June 10, 2026, the plugins have accumulated over 25,000 downloads each for two variants—though download counts may be artificially inflated.

All 15 plugins share a common codebase. Users must enter an API key for providers like OpenAI, SiliconFlow, or DeepSeek via the settings panel. The plugins then exfiltrate that key in plaintext over HTTP to server 39.107.60[.]51. A paid tier adds a bizarre twist: after users pay a small fee, the server returns a working API key for model calls. This suggests the operators are reselling stolen credentials to other threat actors—effectively operating an LLMjacking service where victims pay the provider bills.

Simultaneously, two Chrome extensions—Smart Adblocker (90,000 users) and Adblock for Browser (10,000 users)—have been intercepting AI chatbot conversations across ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Researcher Jean-Marie R. codenamed the operation PromptSnatcher. The extensions ship a custom interception engine that records full conversation history, model usage, and subscription tier, transmitting data to operator infrastructure under a generic "Enhanced Protection" consent string. Both extensions have been on the Chrome Web Store since 2022 and 2023 respectively, suggesting the AI-poaching features were added via software updates.

For engineering teams, this reinforces a hard lesson: treat plugins and extensions as privileged dependencies. Long-lived secrets pasted into unvetted tools are a direct attack surface. Validate plugin code, monitor outbound HTTP calls, and rotate API keys regularly. The open-source ecosystem remains a lucrative target because it hosts exactly what attackers want—source code, cloud credentials, and paid AI service keys that can be resold.

Source: The Hackers News