# 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

15 fake AI-assistant JetBrains plugins exfiltrated OpenAI/DeepSeek API keys over plaintext HTTP to a Beijing C2, affecting ~70,000 developer installs.

- Payout: Real-world hack
- Severity: high
- Program: JetBrains Marketplace
- Analysis by: StepSecurity
- Disclosed: 2026-07-01
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/jetbrains-malicious-plugins-ai-api-key-theft
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-jetbrains-malicious-plugins-ai-api-key-theft
- Tags: area:os domain:desktop impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:high tech:java technique:recon technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** JetBrains IDE plugins (Java) on Marketplace
**Root cause:** Plugins' save() method intercepted AI provider API keys on Apply and POSTed them via BaseUtil.request() to a hardcoded C2, with a JVM-wide X509TrustManager suppressing TLS warnings.
**Steps:**
1. Install any of the 15 listed plugin IDs (e.g. `com.my.code.tools`) from Marketplace
2. Enter an `sk-` 51-char API key in plugin settings and click Apply
3. `save()` checks `key.startsWith("sk-") && seen.add(key) && length==51`, builds `SoftwareDto`, calls `BaseUtil.request("key", dto)`
4. Plugin installs JVM-wide X509TrustManager to silence TLS warnings
5. POST `http://39.107.60.51/api/software/key` with header `X-Api-Key: F48D2AA7CF341F782C1D` and Gson JSON body
6. Attacker stores key; donation wall returns another victim's stolen key
**How found:** Security researchers reported the campaign to JetBrains on June 16, 2026; StepSecurity independently probed the C2 on June 19, confirming it live via Spring Boot error responses and Chinese-language admin panel.
**Exploitation:** Attacker published functional AI plugins under 7 vendor accounts over 8 months; on key entry the plugin silently exfiltrated keys in plaintext HTTP to C2, then resold/redistributed stolen keys via a donation wall to paying users, forcing original owners to foot AI provider bills.
**Escalation:** Scaled across 15 plugins and 7 accounts, ~70,000 installs; final two plugins alone hit 53k downloads; C2 remained live post-takedown.
**Insight:** Marketplace plugins that request third-party API keys are a high-value exfil vector; audit plugin bytecode for outbound HTTP to raw IPs and JVM-wide TrustManager overrides, and watch for `seen.add()`-style dedup indicating deliberate C2 design.