Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

Researchers uncovered a coordinated malicious campaign: 15 JetBrains Marketplace plugins (including CodeGPT AI Assistant and DeepSeek AI Assist) trick users into pasting AI provider API keys into plugin settings, then exfiltrate those keys in plaintext to an attacker-controlled IP (39.107.60.51) and later reuse or resell them; concurrently, two Chrome adblocker extensions (Smart Adblocker and Adblock for Browser) were found capturing users' AI chatbot conversations across multiple platforms—both operations appear to monetize stolen AI credentials and data.