Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

A coordinated malware campaign targeting JetBrains Marketplace plugins has emerged, with 15 malicious plugins designed to steal AI API keys from users. These plugins, posing as AI coding assistants, exfiltrate keys to a remote server, potentially enabling illicit monetization schemes. Simultaneously, two Google Chrome extensions, dubbed PromptSnatcher, have been discovered capturing conversations with AI chatbots like ChatGPT and Gemini. This highlights a growing trend of threat actors targeting developer environments and AI services through open-source tools and telemetry collection.