{
  "title": "15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers",
  "summary": "StepSecurity and JetBrains say 15 malicious JetBrains Marketplace plugins stole AI provider API keys from developers, then a remote kill-switch and marketplace purge removed the listings and banned the publisher accounts.",
  "date": "2026-06-19",
  "severity": "critical",
  "tags": [
    "jetbrains-marketplace",
    "ide-plugins",
    "supply-chain",
    "credential-theft",
    "developer-workstations",
    "ai"
  ],
  "sources_count": 3,
  "indicators": {
    "slug": "jetbrains-malicious-plugins-ai-api-key-theft",
    "since": "2026-06-19T00:00:00Z",
    "until": "2026-06-19T23:59:59Z",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "org.sm.yms.toolkit",
      "com.json.simple.kit",
      "org.bug.find.tools",
      "org.translate.ai.simple",
      "com.yy.test.ai.simple",
      "com.dev.ai.toolkit",
      "com.json.view.simple",
      "com.my.git.ai.kit",
      "org.check.ai.ds",
      "com.review.tool.code",
      "org.code.assist.dev.tool",
      "com.coder.ai.dpt",
      "com.my.code.tools",
      "ord.cp.code.ai.kit",
      "com.dp.git.ai.tool"
    ],
    "urls": [
      "http://39.107.60.51/api/software/key`",
      "http://39.107.60.51/api/software/check`"
    ],
    "ips": [],
    "hashes": [],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}