Malicious JetBrains Marketplace AI Plugins — Supply-Chain AI Key Theft

A coordinated software supply-chain campaign placed 15 malicious plugins on the official JetBrains Marketplace, all masquerading as AI coding assistants (DeepSeek-themed: AI chat, code review, bug detection, commit-message and unit-test generation). The plugins function as advertised — which is precisely what keeps them resident — while covertly harvesting the AI-provider API keys the developer pastes into them. Targeted credentials are OpenAI, DeepSeek, and SiliconFlow API keys.

Stolen keys are exfiltrated in plaintext over HTTP to a single command-and-control server, 39.107.60[.]51. The operation includes an illicit resale twist: after victims paid through the plugins' integrated donation systems, the plugins returned other victims' stolen keys — i.e. a key-resale racket running on top of the theft.

Scale and timeline: roughly 70,000 installs; campaign active since late October 2025, with the newest malicious plugin published 2026-06-10. Aikido Security reported the activity; JetBrains received reports on 2026-06-16 and publicized the takedown on 2026-06-17 — removing the plugins, blocking the publisher accounts, and remotely disabling the plugins in already-installed IDEs via its backend.

A related Chrome "Prompt Poaching" angle pairs with this campaign: two ad-blocker extensions (Smart Adblocker and Adblock for Browser) captured AI chatbot conversations (ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) via a custom interception engine — a parallel AI-data-theft vector worth hunting alongside the IDE plugins.

Defender priority: The single highest-value detection is any outbound connection from a JetBrains IDE process (or its bundled JBR java runtime) to 39.107.60.51, especially plaintext HTTP POSTs. Treat any hit as confirmed AI-key exfiltration: rotate every OpenAI / DeepSeek / SiliconFlow key entered on that host, then enumerate installed plugins for the 15 named directories.

Decision: C2 39.107.60.51 and the 15 plugin names are treated as published, high-confidence IOCs. No file hashes or additional C2 infrastructure were published at time of writing — hash IOCs in the appendix use REPLACE_WITH_… placeholders pending sandbox/tenant confirmation. Chrome extension IDs were not published; hunt by extension name.

Hunt hypotheses

• H1 — A JetBrains IDE process or its JBR java runtime on a developer endpoint establishes outbound connections to 39.107.60.51 (direct AI-key exfiltration).
• H2 — One or more of the 15 named malicious plugin directories exist under the JetBrains config/plugins path on managed developer hosts.
• H3 — A JetBrains IDE / JBR runtime makes plaintext-HTTP POSTs or beacons to rare external IPs not seen across the fleet (unknown exfil endpoints beyond the known C2).
• H4 — Chrome carries Smart Adblocker or Adblock for Browser (AI-conversation interception, "Prompt Poaching").

Attack chain

Endpoint / filesystem (no EDR required)

• Windows: Enumerate %APPDATA%\JetBrains\<Product>\plugins\ for any of the 15 named directories. PowerShell: Get-ChildItem "$env:APPDATA\JetBrains\*\plugins" -Directory and match against the IOC plugin list.
• macOS: Inspect ~/Library/Application Support/JetBrains/<Product>/plugins/.
• Linux: Inspect ~/.local/share/JetBrains/<Product>/plugins/.
• Chrome: Inventory installed extensions; flag Smart Adblocker and Adblock for Browser. Check Default\Extensions\ manifests for those names.

Network / proxy

• Search firewall / proxy / NetFlow for any traffic to 39.107.60.51 (any port; HTTP/80 most likely).
• Hunt for cleartext-HTTP POSTs originating from developer subnets toward newly-seen Chinese-hosted IPs.

JetBrains IDE

• Review IDE notification log for JetBrains' remote "plugin disabled" events (06-17 onward) — these mark hosts that had a malicious plugin installed.

// HUNT: Endpoint network connection to JetBrains AI-plugin C2 39.107.60.51
// MITRE: T1041, T1567, T1071.001  |  CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4 telemetry (Falcon Insight)
// FALSE POSITIVES: none expected; bare campaign exfil IP
// TUNING: none needed; promote straight to alert
#event_simpleName=NetworkConnectIP4 RemoteAddressIP4="39.107.60.51"
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Protocol_decimal], limit=200)

// HUNT: JetBrains IDE / JBR runtime egress to rare external IPs (unknown exfil)
// MITRE: T1041, T1071.001  |  CONF: medium  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 with ContextBaseFileName attribution
// FALSE POSITIVES: plugin/marketplace update servers, AI API endpoints, CDNs
// TUNING: raise host-count threshold; allowlist known AI/CDN ranges
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(idea64|pycharm64|webstorm64|goland64|clion64|rider64|phpstorm64|rubymine64|java)\.exe$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"])
| groupBy([RemoteAddressIP4], function=([count(aid, distinct=true, as=host_count), collect([ComputerName, ContextBaseFileName, RemotePort])]))
| host_count<=3
| sort(host_count, order=asc)

// HUNT: Creation/presence of a named malicious JetBrains plugin directory
// MITRE: T1195.002, T1059.007  |  CONF: high  FP: low  COST: medium
// REQUIRES: File write telemetry (TargetFileName)
// FALSE POSITIVES: legitimate "CodeGPT" plugin (verify exact name)
// TUNING: scope to JetBrains plugins paths only to cut volume
#event_simpleName=/^(NewExecutableWritten|PeFileWritten|FileWritten|RansomwareOpenFile)$/
| TargetFileName=/[\\\/](\.local[\\\/]share[\\\/]JetBrains|Application Support[\\\/]JetBrains|JetBrains)[\\\/][^\\\/]+[\\\/]plugins[\\\/]/i
| TargetFileName=/(DeepSeek (Junit Test|Git Commit|FindBugs|AI Chat|Dev AI|AI Coding|Coder AI|Code Review|AI Assist)|AI (FindBugs|Git Commitor|Coder Review|Coder Assistant)|CodeGPT AI Assistant|Coding Simple Tool)/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName], limit=200)

// HUNT: DNS request resolving to / referencing C2 39.107.60.51
// MITRE: T1071.001, T1041  |  CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: low; bare campaign exfil IP
// TUNING: pair with Q1 for IP-level confirmation
#event_simpleName=DnsRequest
| IP4Records="39.107.60.51" OR DomainName=/39\.107\.60\.51/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, DomainName, IP4Records], limit=200)

// HUNT: Chrome "Prompt Poaching" ad-blocker extension artifacts on disk
// MITRE: T1176 (Browser Extensions), T1555  |  CONF: medium  FP: medium  COST: medium
// REQUIRES: File write telemetry on browser profile paths
// FALSE POSITIVES: legitimately-named ad-blockers; confirm manifest
// TUNING: pivot to extension ID once published; verify name in manifest.json
#event_simpleName=/^(FileWritten|NewExecutableWritten|PeFileWritten)$/
| TargetFileName=/[\\\/](Google[\\\/]Chrome|Chromium)[\\\/].*[\\\/]Extensions[\\\/]/i
| TargetFileName=/(Smart\s*Adblocker|Adblock\s*for\s*Browser)/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName], limit=200)

// HUNT: JetBrains IDE spawning network-capable child processes
// MITRE: T1059, T1041  |  CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with parent lineage
// FALSE POSITIVES: build/terminal plugins shelling out; developer CLI use
// TUNING: correlate child egress with Q1/Q2; baseline per-developer shell use
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(idea64|pycharm64|webstorm64|goland64|clion64|rider64|phpstorm64|rubymine64)\.exe$/i
| ImageFileName=/[\\\/](curl|wget|powershell|pwsh|cmd|bitsadmin|certutil)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

Field note: IP4Records in Q4 is the resolved-address field on DnsRequest events; validate the exact field name in your tenant's DNS schema. All other fields are standard Falcon data-model names.

IOA deployment path: Falcon console → Endpoint security → Custom IOA Rule Groups → create platform-specific group (Windows/Mac/Linux) → add rules above → assign to developer-workstation prevention policy.

Grouped quick-copy blocks for bulk ingestion. Atomic IOCs not yet published use REPLACE_WITH_… placeholders — confirm in tenant/sandbox before promoting to prevent.

type,value,action,severity,expiration,description,tags
ipv4,39.107.60.51,detect,critical,2026-12-20,JetBrains AI-plugin exfil C2 (plaintext HTTP),campaign:JetBrainsAIPluginSupplyChain
sha256,REPLACE_WITH_SHA256,detect,high,2026-12-20,Malicious plugin JAR (confirm in tenant),campaign:JetBrainsAIPluginSupplyChain

DeepSeek Junit Test
DeepSeek Git Commit
DeepSeek FindBugs
DeepSeek AI Chat
DeepSeek Dev AI
DeepSeek AI Coding
AI FindBugs
AI Git Commitor
AI Coder Review
DeepSeek Coder AI
AI Coder Assistant
DeepSeek Code Review
CodeGPT AI Assistant
DeepSeek AI Assist
Coding Simple Tool

# Behavioral signatures
- JetBrains IDE / JBR java -> outbound to 39.107.60.51 (any port)
- Plaintext HTTP POST of API-key-shaped data from developer subnet
- Named malicious plugin dir under JetBrains plugins/ path
- Chrome ext: "Smart Adblocker" / "Adblock for Browser" intercepting AI chats
- IDE-spawned curl/wget/powershell making external connections

# Chrome extension hunt (match by name in manifest/locale)
Smart Adblocker
Adblock for Browser

# Response audit checklist
- Rotate ALL OpenAI / DeepSeek / SiliconFlow keys entered on affected hosts
- Inventory JetBrains plugins on every developer endpoint
- Confirm JetBrains backend plugin-disable notification fired (06-17+)
- Block 39.107.60.51 at egress proxy/firewall

1 · Windows — enumerate JetBrains plugins for the 15 names

$names = @('DeepSeek Junit Test','DeepSeek Git Commit','DeepSeek FindBugs','DeepSeek AI Chat',
  'DeepSeek Dev AI','DeepSeek AI Coding','AI FindBugs','AI Git Commitor','AI Coder Review',
  'DeepSeek Coder AI','AI Coder Assistant','DeepSeek Code Review','CodeGPT AI Assistant',
  'DeepSeek AI Assist','Coding Simple Tool')
Get-ChildItem "$env:APPDATA\JetBrains\*\plugins" -Directory -ErrorAction SilentlyContinue |
  Where-Object { $n=$_.Name; $names | Where-Object { $n -like "*$_*" } } |
  Select-Object FullName

2 · macOS / Linux — same sweep

for d in "$HOME/Library/Application Support/JetBrains"/*/plugins \
         "$HOME/.local/share/JetBrains"/*/plugins; do
  [ -d "$d" ] && ls -1 "$d" | grep -Ei 'DeepSeek (Junit Test|Git Commit|FindBugs|AI Chat|Dev AI|AI Coding|Coder AI|Code Review|AI Assist)|AI (FindBugs|Git Commitor|Coder Review|Coder Assistant)|CodeGPT AI Assistant|Coding Simple Tool' \
    && echo "  ^ in $d"
done

3 · Chrome — enforce extension allowlist (managed policy registry)

# HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist = *
# then allowlist only approved IDs in ExtensionInstallAllowlist.
# Removes Smart Adblocker / Adblock for Browser unless explicitly approved.

4 · Egress block (firewall pseudo-rule)

deny outbound any -> 39.107.60.51 any   # JetBrains AI-plugin exfil C2
log  outbound dev-subnet -> any :80      # surface cleartext HTTP for review

Gaps: The credential-capture step (T1552.001) has no direct telemetry — the theft happens in-memory inside the plugin. Coverage relies on detecting the downstream exfil (Q1/Q4) and the plugin's presence (Q3). Validation gates (S11) must confirm Q1/Q4 fire on a lab connection before promotion.