Fifteen Rogue JetBrains Plugins Posed as DeepSeek Assistants to Siphon AI Keys

Key points

• Researchers identified 15 malicious plugins on the JetBrains Marketplace, each posing as a DeepSeek-powered coding assistant.
• The plugins offered chat, commit-message generation, code review, bug finding and unit-test scaffolding while stealing AI provider API keys in the background.
• AI API keys have real resale value: stolen tokens can be fed into reverse-proxy operations or burned for free model inference.
• JetBrains plugins run with IDE-level privileges, giving a rogue plugin access to project files, environment variables and plaintext config.
• Developers should audit installed plugins, rotate any exposed keys and store credentials in a secrets manager.

Someone went shopping for developer credentials, and they did the lazy way: fake AI coding assistants on the JetBrains Marketplace.

Researchers flagged the campaign as coordinated, with at least 15 plugins, all marketed as DeepSeek-powered coding helpers offering chat, commit-message generation, code review, bug finding and unit-test scaffolding. The actual function was exfiltrating AI provider API keys from developers who installed them.

We covered the same underlying playbook on 9 June 2026, when Microsoft and Google both documented credential-theft campaigns dressed up as ChatGPT and DeepSeek experiences. The technique hasn't changed. Only the delivery vehicle has.

Should you worry about stolen AI keys?

Yes, and more than most developers currently do. A leaked OpenAI or Anthropic key can be resold, fed into a reverse-proxy reseller operation on Telegram, or simply burned for free inference until the rate limits fire. The buyer doesn't need to launder anything: a working token is enough.

The attack surface here is mundane in the worst way. JetBrains plugins run with the same privileges as the IDE itself, meaning access to project files, environment variables, .env files and shell history if the plugin feels ambitious. A plugin that legitimately needs an OpenAI key to function has a perfectly normal-looking reason to read one and phone home. It's a supply-chain compromise in a chatbot costume.

Fifteen plugins is not opportunistic. That number points to shared infrastructure, shared exfiltration endpoints or at minimum a coordinated author network gaming the marketplace review process.

What developers and security teams should do now

Audit installed JetBrains plugins. Anything unfamiliar that carries DeepSeek or generic LLM-assistant branding deserves scrutiny before it runs another session.

Rotate AI provider keys that have been sitting in IDE configs or .env files on machines where unvetted plugins were installed. Treat those keys the way you'd treat a leaked cloud credential: assume compromise, revoke, reissue.

Scope and rate-limit keys at the provider side, and move them into a secrets manager rather than plaintext config. Watch billing dashboards: unexpected token spend is often the first signal a key has left the building.

What needs to change at the platform level

JetBrains will need to tighten marketplace review. The "LLM wrapper as malware delivery" pattern is going to keep working until platforms treat AI-branded plugin submissions with the same suspicion they'd apply to a new browser wallet extension. The IDE is effectively the new browser, and attackers already know it. Defenders are catching up.