Cybersecurity researchers have uncovered a new malware campaign that targeted software developers through the JetBrains Marketplace. Attackers uploaded 15 malicious plugins disguised as AI coding assistants. These plugins promised useful features such as code review, bug detection, unit test generation, and AI-powered coding help. However, their real purpose was to steal sensitive API keys from users.
The malicious plugins were designed to look and behave like legitimate AI development tools. Researchers found that the plugins worked exactly as advertised, making them difficult for users to identify as malicious. Developers who entered API keys for AI services unknowingly shared those credentials with servers controlled by the attackers. This allowed threat actors to collect valuable access tokens without raising suspicion.
The stolen credentials included API keys linked to popular AI platforms such as OpenAI, DeepSeek, and SiliconFlow. Once attackers gained access to these keys, they could potentially abuse paid AI services, generate unauthorized costs, or gain access to resources connected to those accounts. Security experts warned that compromised API keys can create serious risks for both individuals and organizations.
Researchers said the campaign highlights a growing trend in which cybercriminals target trusted software marketplaces. Instead of delivering obvious malware, attackers are creating tools that provide real functionality while secretly collecting sensitive information. This approach increases the chances of victims installing the software because it appears useful and operates as expected.
At the same time, security teams have also identified malicious Chrome extensions targeting users of AI chatbots. These browser extensions pretended to offer AI productivity and assistant features but secretly collected conversations from ChatGPT and DeepSeek users. The stolen data was then transmitted to infrastructure controlled by the attackers without the users’ knowledge.
Investigators discovered that the malicious extensions did not stop at capturing chatbot conversations. They were also gathering browsing information, including URLs of open tabs and other web activity. Some of these extensions attracted hundreds of thousands of users by impersonating legitimate AI tools, significantly increasing the scale and impact of the campaign.
Security researchers believe these incidents show how attackers are increasingly focusing on the rapidly growing AI ecosystem. Instead of attacking AI providers directly, cybercriminals are targeting the tools, plugins, and browser extensions that users trust every day. This method allows them to steal credentials, monitor activity, and collect valuable information while remaining hidden for long periods.
Experts recommend that users carefully review plugins and browser extensions before installing them. Organizations should regularly audit installed software, remove unnecessary extensions, rotate exposed API keys, and monitor systems for unusual network activity. The discoveries serve as a reminder that even trusted marketplaces can be abused, making caution essential when adopting new AI-powered tools.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
