JETBRAINS MARKETPLACE PLAGUED BY 15 API KEY-STEALING PLUGINS

AI DESK■ 1 MIN READ

WED, JUN 17, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Researchers discovered at least 15 malicious plugins on the JetBrains Marketplace designed to steal AI API keys from developers. The plugins bypassed security checks and posed as legitimate development tools.

The malicious plugins targeted developers using popular JetBrains IDEs, including IntelliJ IDEA and PyCharm. They were engineered to extract API keys for services like OpenAI, Anthropic, and other AI platforms—credentials that could grant attackers access to expensive API services or sensitive project data. JetBrains removed the plugins after security researchers identified the threat. The incident highlights vulnerabilities in marketplace vetting processes and raises concerns about supply chain attacks targeting developer tools. Developers using JetBrains products should audit installed plugins and review API key exposure. Users should rotate compromised credentials immediately. JetBrains has not disclosed how long the plugins remained available or how many installations occurred before removal. This incident follows similar marketplace security incidents across platforms like VS Code and Chrome, underscoring the persistent risk of malicious extensions targeting developers.

■ SOURCES

► Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

P661HEDGE FUNDS TARGETED IN BLACKFILE-LINKED ATTACK WAVE

Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.

2H AGO— Security Desk

P659CLICKFIX ATTACKS DEPLOY MACOS MALWARE FOR CRYPTO THEFT

A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.

4H AGO— Industry Desk

P653EX-NSA CHIEF: WATER SYSTEMS SHOULD STAY OFFLINE

A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.

9H AGO— Industry Desk

P641POLISH COURTS, HOSPITALS, AIRPORTS FACE HACK RISKS

Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.

12H AGO— AI Desk

◄ BACK TO NEWS

JETBRAINS MARKETPLACE PLAGUED BY 15 API KEY-STEALING PLUGINS

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF