Fifteen JetBrains Marketplace Plugins Found Stealing API Keys

Aikido Security discovered at least 15 malicious JetBrains IDE plugins (dating from Oct 2025 to June 2026) installed ~70,000 times that pose as AI coding assistants; when users paste AI-provider API keys into plugin settings the key is immediately saved locally and exfiltrated to an attacker-controlled server, likely for resale or use to pay for model compute. The plugins function normally otherwise, include a paid tier that may distribute stolen keys, and Aikido published related IoCs.