Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

JetBrains plugins leak API keys, 70k installs since 2025

Part of the JetBrains story · since 17 Jun

Quiet for 19 weekslast report 19 Jun3 articles3 outlets
17 Jun · Infosecurity first27 Aug20 SepNowThis article1st of 3
  • Wed 17 Jun, 09:31 UTC. Infosecurity, first report. JetBrains plugins leak API keys, 70k installs since 2025. This article, 1st of 3.
  • Wed 17 Jun, 10:10 UTC. The Hacker News, its first report on the story. JetBrains Plugins Steal AI API Keys via Chrome Extensions.
  • Fri 19 Jun, 21:16 UTC. StepSecurity, its first report on the story. 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers.

Security researchers from Aikido Security discovered 15 malicious plugins on the JetBrains Marketplace that have been stealing API keys from developers. These plugins, posing as AI coding assistants, have been installed approximately 70,000 times since their initial appearance in October 2025, with some updates released as recently as June 2026. When developers enter their API keys for services like OpenAI, these keys are immediately exfiltrated to a server controlled by attackers without user consent.

The campaign's ultimate goal remains unclear, but stolen API keys could be resold or misused. Aikido highlighted the increasing targeting of integrated development environments (IDEs) by cybercriminals due to the wealth of sensitive information they possess.

How the story developed

All 3 articles
Quiet for 19 weekslast report 19 Jun3 articles3 outlets

3 articles from 3 outlets since 17 Jun. Quiet since 19 Jun. This was the first report.

Now17 Jun17181920211 NovFirst reportInfosecurity · 17 Jun, 09:31Picked up againafter 2 days quiet
  • Wed 17 Jun, 09:31 UTC. Infosecurity, first report. JetBrains plugins leak API keys, 70k installs since 2025. This article, 1st of 3.
  • Wed 17 Jun, 10:10 UTC. The Hacker News, its first report on the story. JetBrains Plugins Steal AI API Keys via Chrome Extensions.
  • Fri 19 Jun, 21:16 UTC. StepSecurity, its first report on the story. 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Wed 17 JunDay 02
    1. JetBrains plugins leak API keys, 70k installs since 202509:31 · Infosecurity · First report · This article, 1st of 3
    2. JetBrains Plugins Steal AI API Keys via Chrome Extensions10:10 · The Hacker News

  2. Quiet for 2 days

    Fri 19 JunDay 21
    1. 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers21:16 · StepSecurity · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in