Security researchers have uncovered a coordinated campaign designed to steal developers’ AI-related API keys via malicious plugins. Aikido Security found at least 15 integrated development environment (IDE) plugins on the JetBrains Marketplace which had slipped past security checks and have now been installed around 70,000 times. They apparently date back to October 2025, with the most recent plugins released in June 2026.