Malicious JetBrains Marketplace Plugins Discovered Stealing AI API Keys from Developers
A Three-Stage Vulnerability Chain Turning Microsoft 365 Copilot Into a Silent Data Exfiltration Weapon
The Digital Trove: How a Single Hack Exposed One Man’s Entire Life and Why We’re All Vulnerable
FIFA Bug in World Cup Streaming Infrastructure Opened Door to Remote Takeover
Passkeys vs Passwords: Readers Debate Whether a Smartphone PIN Can Really Be Safer Than a Complex Password
https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys
Security researchers have uncovered malicious plugins on the JetBrains Marketplace that have been specifically designed to steal AI API keys from developers, targeting credentials used to access services such as OpenAI, Anthropic, and other prominent AI platforms. The discovery raises serious concerns about the security of third-party plugin ecosystems that developers routinely trust and install into their integrated development environments, often without subjecting them to the same level of scrutiny applied to other software components.
The malicious plugins are understood to have been crafted to blend in with legitimate development tooling, making them difficult for unsuspecting developers to identify as threats during the installation process. Once installed within a JetBrains IDE such as IntelliJ IDEA, the plugins quietly harvest AI API keys stored within the developer’s environment, whether held in configuration files, environment variables, or IDE settings, and exfiltrate them to attacker-controlled infrastructure. Stolen AI API keys can be exploited in a number of damaging ways, including running up substantial charges on the victim’s account, accessing proprietary AI fine-tuning data, or being resold on underground marketplaces to other threat actors seeking to abuse AI services at the expense of legitimate account holders.
Developers are urged to exercise caution when installing plugins from any marketplace, carefully reviewing publisher credentials, download counts, and user reviews before proceeding. JetBrains is expected to investigate and remove the identified malicious plugins from its marketplace, though the incident reinforces broader calls for platform operators to implement more rigorous automated and manual vetting processes for third-party submissions. Developers who believe they may have installed affected plugins are strongly advised to immediately rotate any AI API keys stored within their development environments and audit their accounts for signs of unauthorised usage.
https://www.varonis.com/blog/searchleak
Varonis Threat Labs has disclosed a critical vulnerability chain dubbed SearchLeak that transforms Microsoft 365 Copilot Enterprise Search into a silent data exfiltration tool, capable of extracting emails, security codes, calendar entries, SharePoint documents, and OneDrive files from a victim’s account with nothing more than a single click on an unsuspicious link. The attack chain combines three distinct weaknesses: a relatively new AI-specific vulnerability class known as Parameter-to-Prompt Injection, an HTML rendering race condition, and a server-side request forgery exploit abusing Bing’s image search infrastructure. Microsoft has since remediated the vulnerability under CVE-2026-42824, assigning it a maximum severity rating of critical, though the disclosure underscores the increasingly dangerous intersection between AI assistant capabilities and classic web security weaknesses.
The first stage of the attack exploits the fact that Microsoft 365 Copilot Enterprise Search passes the URL query parameter directly to Copilot’s AI engine as an executable prompt rather than treating it purely as a search string. An attacker crafts a malicious URL instructing Copilot to search the victim’s emails and embed the extracted content within an image URL, meaning the victim need only click the link for Copilot to silently harvest and prepare their data for exfiltration. The second stage exploits a race condition in Microsoft’s output sanitisation process, whereby raw HTML including an embedded image tag is temporarily rendered in the browser’s DOM during Copilot’s streaming response phase before the guardrail wraps the output in code blocks. Because the browser fires the image request the moment it encounters the tag during streaming, the data leaves the victim’s environment before the sanitiser ever activates, rendering the post-processing mitigation entirely ineffective.
The third and final stage resolves the obstacle posed by the Content Security Policy on the Microsoft 365 domain, which restricts which external domains the browser is permitted to load images from and would ordinarily block a direct request to an attacker-controlled server. The researchers discovered that Bing’s image search endpoint, which is explicitly allowlisted in the Content Security Policy given its status as a Microsoft-owned domain, accepts a URL parameter and performs a server-side fetch of that URL from Bing’s own infrastructure to analyse the image. By pointing the injected image tag at Bing’s search-by-image endpoint with the stolen data embedded in the URL path, the attacker effectively transforms Bing into an unwitting exfiltration proxy, with Bing’s backend silently forwarding the request containing the victim’s data to the attacker’s server entirely outside the reach of the browser’s content security controls. Because the malicious link points to a trusted Microsoft domain, traditional anti-phishing and URL protection tools offer no protection against the attack.
https://nymag.com/intelligencer/article/your-digital-self-is-vulnerable.html
The New York Magazine published a fantastic article about how a person who had good security practices had years of personal information exposed. The breach had originated when the person downloaded a plugin from GitHub while experimenting with an AI image generator, a file that appeared legitimate and had been positively reviewed by others but contained a Trojan-horse virus that gave the attackers unrestricted access to his PC. The hackers had patiently waited for him to log into his password manager, 1Password, which he had diligently used for over a decade to manage more than one thousand accounts including iCloud, iMessage, email, PayPal, financial records, medical records, social media, and his parents’ financials, effectively handing the attackers a master key to every dimension of his life.
The group responsible exposed every personal login credential, private messages, bank information, medical diagnoses, and Amazon account details to anyone who cared to look. They had also leveraged their access to extract a vastly larger cache of Disney corporate data, including employee Social Security numbers, Slack messages, budget spreadsheets, and passport information for cruise-line workers, turning the personal compromise into one of the most significant corporate breaches in the company’s history. As the stolen data circulated online, the victim’s iPhone began pinging continuously with account takeover attempts, anonymous callers left voicemails mocking his medical conditions, and unknown individuals logged into his children’s Roblox accounts to post Nazi content. Van Andel raced through his house unplugging Ring cameras and Amazon Echo devices, confronting in visceral and overwhelming terms the sheer breadth of everything he had ever recorded online and the catastrophic permanence of its exposure.
The breach is a vivid illustration of a vulnerability that extends far beyond technology professionals to encompass virtually every person who has accumulated years of digital activity across the same email addresses, phone numbers, cloud accounts, and messaging platforms. Cybercrime is rising at alarming rates in what security experts have described as the golden age of hacking, but private digital archives can also be exposed through entirely legal means, as demonstrated by the 2025 OpenAI litigation that surfaced decades of private group chats and personal diary entries, or the blast radius of the Justice Department’s release of the Epstein files, which swept up thousands of ordinary correspondents as collateral damage. The psychological instinct to believe that having nothing to hide provides protection is a false comfort, because the digital self most people express in text messages, search histories, private emails, and group chats is a candid first draft never intended for public consumption, one that is nevertheless sitting largely intact and searchable across servers around the world. The convenience that made storing, backing up, and transferring this data so effortless across years and devices is precisely the same quality that makes the trove, once breached, so catastrophically comprehensive.
https://bobdahacker.com/blog/fifa-hack
A security vulnerability discovered in FIFA’s digital infrastructure supporting World Cup streaming has been found to expose the platform to remote takeover, raising significant concerns about the cybersecurity posture of one of the world’s most watched and commercially valuable sporting events. The flaw, uncovered by security researchers and reported to FIFA ahead of public disclosure, represents the kind of high-profile target that threat actors ranging from financially motivated cybercriminals to state-sponsored groups would find enormously attractive, given the scale of the audience and the volume of sensitive user and financial data flowing through the platform during tournament periods. The discovery serves as a timely reminder that major sporting organisations managing large-scale digital broadcasting operations face the same class of application security risks as any enterprise technology provider, often without the same depth of security expertise or investment.
The vulnerability is understood to have been present within the web application layer of FIFA’s streaming infrastructure, where insufficient input validation or misconfigured access controls created an opening through which a remote attacker could potentially gain unauthorised control over components of the platform without requiring physical access or insider credentials. Remote code execution and application takeover vulnerabilities of this nature represent some of the most severe risks in application security, as they can allow an attacker to manipulate platform behaviour, intercept user data, disrupt live streaming services, or use compromised infrastructure as a launchpad for further attacks against connected systems. The potential for service disruption during a live World Cup broadcast, an event drawing hundreds of millions of concurrent viewers, would carry consequences measured not just in reputational damage but in substantial financial and contractual liability for the organisation.
The responsible disclosure of this particular vulnerability allowed FIFA an opportunity to remediate the flaw before it could be exploited maliciously, though the incident highlights how frequently critical security weaknesses go undetected in high-profile platforms until an external researcher takes the initiative to look. Organisations operating streaming and broadcast infrastructure at global scale are being advised to treat application security as a continuous discipline rather than a pre-launch checklist item, particularly as the commercial and reputational stakes surrounding major live events make them increasingly attractive targets for those seeking to cause maximum disruption or extract maximum value from a successful intrusion.
A lively reader debate has erupted in The Guardian’s long-running Notes and Queries column after a reader from Chester posed a question that has been quietly nagging at many people navigating the increasingly confusing landscape of digital security: how can a passkey, which can be as simple as a smartphone PIN or facial recognition scan, genuinely be safer than a complex password combined with two-factor authentication? The question cuts to the heart of a widespread public scepticism surrounding passkeys despite their enthusiastic endorsement by bodies including the UK’s National Cyber Security Centre, and prompted a range of responses from readers spanning genuine technical insight, pragmatic scepticism, and outright suspicion that the whole thing is a scheme by software companies to sell products nobody actually needs.
The most technically substantive responses centred on a fundamental weakness built into the traditional password model known as the shared secret problem. When a user logs into a website using a password, that password must be transmitted to and verified by the website’s server, meaning a copy of it, or a value derived from it, necessarily exists on infrastructure outside the user’s control. If that server is compromised, the password can be extracted and reused by an attacker without the account holder ever knowing. Passkeys sidestep this problem entirely through a mathematical approach in which only the result of a cryptographic calculation is sent to the website during authentication, never the passkey itself, meaning a server breach yields nothing an attacker can use to impersonate the account holder elsewhere. The passkey remains stored locally on the user’s device and is unlocked through a PIN or biometric, combining strong underlying cryptographic security with everyday convenience.
Several readers raised practical concerns that reflect the genuine friction points passkeys introduce for ordinary users, including the implications of a stolen or lost phone, the challenge of accessing accounts across multiple devices, and the difficulty of recovering access when all devices have been lost simultaneously. One reader noted that while a hacked password may go undetected for months or years, a stolen phone is typically noticed almost immediately, allowing the owner to revoke associated passkeys before they can be abused, a meaningful practical advantage that the raw technical comparison between PINs and passwords tends to obscure. Others remained unconvinced, with one reader expressing preference for passwords written on paper in a coded format stored across separate locations, voicing a broader suspicion that the push towards passkeys serves the commercial interests of technology platforms more than it serves ordinary users.
The debate shows that despite passkeys representing a genuine security advancement, widespread adoption will depend not just on technical superiority but on building public understanding and trust in a concept that remains counterintuitive to many people conditioned to equate security with complexity and length of passwords.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.