Originally published on
[satyamrastogi.com]
Security researchers identified 15 malicious JetBrains plugins masquerading as DeepSeek AI assistants. Attack chain harvests API keys, exfiltrates LLM chat sessions, and establishes persistence in development environments. Supply chain pivot to downstream applications.
A coordinated malware campaign has compromised the JetBrains Marketplace with at least 15 malicious plugins, each posing as AI coding assistants built on DeepSeek and competing LLM providers. This represents a critical supply chain vulnerability exploiting developer trust in the IDE ecosystem.
From an attacker's perspective, this campaign is textbook brilliant: developers install these plugins voluntarily, grant IDE-level permissions automatically, and the malware operates within trusted processes. The payload exfiltrates AI API keys (OpenAI, Anthropic, Claude, Gemini), captures chatbot session transcripts, and potentially establishes persistence for post-exploitation.
The attack leverages Shadow AI Exploitation blind spots - organizations don't control developer tool selection or monitor what extensions are installed in local IDEs.
The malicious plugins use DeepSeek branding and legitimate feature descriptions to bypass manual review. This exploits several psychological vulnerabilities:
Developer Blind Trust in IDE Marketplaces - Unlike app stores with reputation systems, JetBrains Marketplace has inconsistent vetting. Developers assume marketplace curation prevents malicious content.
Legitimate Feature Set - Plugins advertise real functionality (chat, commit messages, code review, unit tests) that developers genuinely want. The malware is parasitic, not obvious.
Supply Chain Authority - JetBrains' official marketplace position creates false legitimacy. Users don't validate plugin publisher identity or update history.
This maps to MITRE ATT&CK T1195 (Supply Chain Compromise) with subclass T1195.001 (Compromise Software Repository). The campaign likely targets the marketplace as the software repository, not downstream consumers.
Once installed, plugins execute with IDE process privileges and access to developer's local environment:
API Key Exfiltration - IDE configurations typically store API keys in plaintext or weakly encrypted formats. OpenAI keys, Anthropic credentials, Google Gemini tokens live in .env
files, config files, or environment variables. A plugin can enumerate and exfiltrate in seconds.
LLM Chat Session Capture - Chrome extension variant captures chatbot conversations in transit. Credentials transmitted in HTTP headers or request bodies become accessible. This captures proprietary code reviewed with AI assistants, internal architecture discussions, and sensitive prompts.
Local File System Access - IDE plugins have filesystem read access. Attackers can harvest source code, git configs with credentials, private SSH keys, and Kubernetes manifests (increasingly common in dev environments).
This is T1555 (Credentials from Password Stores) combined with T1056.004 (Capture Clipboard Data). The Chrome extension variant adds T1087 (Account Discovery) against cloud provider authentication states.
Malicious plugins require command and control (C2) for credential transmission. Attack flow:
Plugin installed locally
|
v
IDE process loads plugin at startup
|
v
Plugin enumerates API keys from:
- ~/.config/*/api_keys
- Environment variables
- .env files in open projects
- Browser localStorage (via extensions)
|
v
Credentials packaged with metadata:
- Developer username
- Project paths
- Git remote URLs
- IDE plugins list
|
v
HTTPS exfiltration to attacker C2
|
v
API keys tested immediately
- OpenAI: query usage/balance
- Anthropic: rate limit probing
- Gemini: auth validation
Once credentials are validated, attackers can:
JetBrains plugins are packaged as ZIP files containing plugin.xml
manifest and compiled code. Malicious variants have:
<idea-plugin>
<name>DeepSeek AI Assistant</name>
<vendor>DeepSeek</vendor>
<description>AI-powered coding assistant</description>
<!-- Legitimate-looking permissions -->
<actions>
<action id="deepseek.chat">Chat with AI</action>
</actions>
<!-- Hidden component for credential harvesting -->
<applicationListeners>
<listener class="com.deepseek.credential.HarvesterComponent"
topic="com.intellij.openapi.startup.StartupActivity.POST_STARTUP"/>
</applicationListeners>
</idea-plugin>
The listener component executes after IDE startup, before user sees anything. This is T1547.011 (Startup Folder) for IDEs.
Unlike transient malware, IDE plugins persist because:
This is T1547 (Boot or Logon Autostart Execution).
The browser extension captures chatbot interactions:
// Content script injecting into ChatGPT/Claude/Gemini pages
function captureConversation() {
const messages = document.querySelectorAll('[data-message-id]');
const headers = document.querySelectorAll('Authorization, X-API-Key');
const payload = {
url: document.location.href,
conversation: extractMessageText(messages),
tokens: extractBearerTokens(headers),
timestamp: Date.now()
};
chrome.runtime.sendMessage(payload); // sends to extension backend
}
This bypasses OAuth token storage mechanisms by capturing tokens during active session, not from storage. Maps to T1185 (Traffic Signaling).
Organizations with IDE telemetry (JetBrains Gateway, corporate deployments) can detect:
~/.config/JetBrains/*/plugins/
for unsigned or unrecognized pluginsjava.exe
or idea.exe
sk-
, AKIA-
, AIza-
patterns
find ~/.config/JetBrains -name "plugin.xml" | xargs grep -l "DeepSeek\|deepseek"
Delete any variants of flagged plugins and regenerate compromised API keys immediately.
Credential Rotation - This is non-negotiable. Any developer with these plugins installed must rotate all AI provider API keys, and check API usage logs for unauthorized queries.
Browser Extension Purge - Remove all Chrome extensions not explicitly whitelisted. Verify against Google's official Safe Browsing list.
IDE Plugin Allowlisting - Implement corporate JetBrains instances with plugin repositories restricted to approved list only. Use JetBrains Fleet with centralized plugin management.
Environment Variable Protection - Enforce that API keys are never stored in environment variables; use credential managers (1Password, HashiCorp Vault, AWS Secrets Manager). Configure IDE to source from these managers only.
Marketplace Review Process - For organizations allowing plugin installation, require manual security review before approval. Check plugin publisher history, update frequency, and community feedback.
Supply Chain Verification - Similar to WordPress plugin supply chain risks, enforce code signing verification for all IDE extensions.
Network Segmentation - Developer machines should have outbound restrictions on API credential transmission. Block direct HTTPS from dev machines to non-whitelisted cloud provider endpoints.
Secrets Scanning in CI/CD - Deploy pre-commit hooks and CI/CD scanning to detect hardcoded API keys before code reaches repositories. Tools like GitGuardian or TruffleHog should fail commits containing credentials.
From defensive perspective, JetBrains should:
Supply chain attacks targeting developer tools are high-ROI: IDE plugins execute with full developer privileges and access to credentials for downstream services (Git, cloud providers, AI APIs). A single compromised plugin can lead to source code theft, API key harvesting, and lateral movement.
Local IDE security is an organizational blind spot: Organizations monitor web browsers and network traffic, but rarely audit what's installed in IDEs. This campaign exploits that governance gap.
API keys are the new crown jewels: AI provider credentials are now worth stealing because they provide access to proprietary models, potentially unlock usage quotas worth thousands, and can be resold to competitors or state actors for prompt injection attacks.
Browser extensions + IDE plugins = dual exfiltration: The coordinated campaign with Chrome extension variant shows attackers are opportunistic. They'll exfiltrate data from multiple attack surfaces simultaneously (IDE + browser).
Trust in marketplaces is misplaced: Unlike Apple App Store or Google Play, IDE and plugin marketplaces have minimal vetting. Developers should treat marketplace installation with same skepticism as down random binaries from the internet.
Shadow AI Exploitation: Why CISOs Are Losing Control of LLM Usage - Organizational blind spots in AI credential and tool governance
WordPress Plugin Supply Chain Attack: Admin Account Injection via CDN Tampering - Similar supply chain compromise methodology in plugin ecosystems
AUR Supply Chain Compromise: 400+ Packages Distributing Linux Rootkit/Infostealer - Attackers compromising package repositories for mass credential harvesting