Loading story…
Critical vulnerabilities in Nitro Software Belgium’s Connective Signing Extension exposed more than 2 million Belgian users to identity and system compromise. The browser-based eID software, used by eight of Belgium’s ten largest banks and more than 60 government agencies, failed to properly validate the origin of website requests, allowing malicious sites, ads, or hidden iframes to access eID and payment card data, replay request tokens, and present spoofed native-looking prompts to steal victims’ eID PINs. Researchers said the flaws could also be abused to submit unauthorized, legally binding electronic signature requests when a victim’s eID card was inserted, creating downstream risk for Belgium’s wider digital identity ecosystem, including services such as CSAM.be and Itsme.
A separate flaw enabled drive-by remote code execution on Windows by letting the local native host load attacker-controlled code from a web-supplied path, even without an eID card connected. Researcher James Arnott disclosed the issues after Nitro remediated them in stages, including disabling unsafe library loading, enforcing origin checks, and changing PIN-token handling; final security enforcement was completed 146 days after the initial report. Nitro, an EU-listed Qualified Trust Service Provider, reportedly paid a $200 bug bounty, and no CVE identifiers had been assigned at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Nitro finished the final security enforcement for the Connective vulnerabilities in late July, concluding remediation 146 days after the initial report. At the time of reporting, no CVEs had been assigned.
Nitro Software Belgium released a first partial fix for the Connective flaws on 8 May 2026, adding origin verification through a remote server. The update did not yet address the DLL-loading remote code execution issue or the pinToken exposure.
Arnott publicly disclosed the Connective findings at DEF CON and in a technical blog post, revealing the impact of the flaws on Belgium's digital identity ecosystem. The disclosure followed Nitro's remediation work.
After receiving the initial report, Nitro Software Belgium rolled out staged fixes including enforcing origin checks, changing PIN-token handling, and disabling risky library loading in the native host. The company also awarded Arnott a $200 bug bounty.
Researcher James Arnott identified multiple vulnerabilities in Nitro Software Belgium's Connective digital identity system, including missing origin validation that exposed eID and payment card data, PIN phishing and signing abuse, as well as a separate drive-by remote code execution issue. The software was widely used across Belgian banks and government services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourceamibeingpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-18397**, a drive-by remote code execution vulnerability in SConnect, a browser extension and native host reportedly used by more than one million users for hardware-token authentication and digital signing. The flaw, reported with a **CVSS score of 9.4**, was demonstrated against version 2.16.0.0 and allowed any visited website or embedded iframe to silently download and execute an unsigned DLL. An uninitialized-memory flaw in SConnect’s custom RSA-2048 verifier, combined with heap spraying, bypassed website authorization and add-on signature checks. SConnect supports sensitive workflows involving SWIFT, 3SKey, electronic IDs, and other signing tokens. Thales received the report on June 29, 2026, subsequently released updates through Apple and Chrome distribution channels, and removed the Edge extension in September. Researchers could not confirm whether existing Edge installations were automatically removed. Organizations should inventory SConnect deployments, verify that both browser extensions and native hosts are updated, and explicitly check for remaining Edge installations, prioritizing financial authentication and signing workstations. The disclosure did not establish the full deployment footprint, demonstrate unauthorized interactions with connected security tokens, or report exploitation in the wild.
Oct 3, 2026
A critical flaw in N-able Passportal’s Chrome and Microsoft Edge extensions allowed a malicious website or embedded iframe to steal access and refresh tokens and fully compromise a user’s password vault. The bug, tracked as **`CVE-2026-15580`** with a **CVSS v4.0 score of 9.4**, stemmed from improper origin validation in `window.postMessage` handling, causing the extension to trust messages from arbitrary sites. Researchers said an attacker could use the stolen tokens to enumerate stored credentials, retrieve live TOTP codes, and maintain access for as long as 100 days through refresh tokens. N-able said the issue affected extension version **3.49.5** and released **3.49.6** within 24 hours, adding origin checks, trusted iframe validation, and nonce validation. Researchers warned that the impact was amplified by Passportal’s broader design, including server-side decryption rather than end-to-end encryption and reports that sensitive key-related material was present in JWT access tokens. The exposure is especially significant for MSPs and downstream customers that rely on Passportal in managed service and supply-chain environments, and defenders were urged to verify updates and consider rotating high-value credentials and TOTP seeds where compromise is possible.
Aug 24, 2026
Dutch investigators found malicious webshells on Citrix NetScaler ADC and NetScaler Gateway appliances at multiple organizations following exploitation of critical 2025 NetScaler vulnerabilities. The affected flaws include `CVE-2025-5777`—an unauthenticated, remotely exploitable out-of-bounds read issue widely known as CitrixBleed 2—along with `CVE-2025-5349` and `CVE-2025-6543`; public proof-of-concept code for `CVE-2025-5777` increased the likelihood of broad exploitation. The Dutch NCSC urged organizations to immediately apply Citrix updates, investigate appliances for signs of compromise, and terminate active ICA, PCoIP, RDP, AAA, and load-balancing persistent sessions after patching. It also released forensic scripts and updated indicators of compromise for reviewing NetScaler coredumps and full appliance images, as researchers warned that exposed and unremediated devices may already have been compromised.
Aug 31, 2026