Two Million Belgians Exposed by Flaws in the Software They Use to Sign Legal Documents Online
Security researcher James Arnott found that Belgium's most-used digital identity tool could let any malicious website steal a user's PIN, forge their electronic signature, or quietly run attack code on their computer, all without the victim clicking anything suspicious.
Key points
- Researcher James Arnott found multiple severe security flaws in the Connective browser extension, used by over 2 million people in Belgium for government and banking authentication.
- Any malicious website or embedded online ad could silently access a user's electronic identity card data and trick them into revealing their PIN.
- A separate flaw allowed attackers to run malicious code on a victim's computer without needing any special permissions.
- Nitro Software Belgium fully fixed the issues 146 days after Arnott's initial report and paid him a $200 bug bounty.
- Eight of Belgium's ten largest banks and over 60 government agencies relied on the affected software.
Belgium runs a national electronic identity system that lets citizens log into government websites, authenticate with banks, and sign contracts using a physical ID card and a browser extension called Connective. Think of it like a digital notary, except it all happens through software on your computer. Over 2 million people use it.
At the DEF CON security conference last week, James Arnott, founder of cybersecurity firm Bay Area Labs, explained how that software had a set of serious, now-fixed flaws that could have let criminals do a lot of damage.
How did the attack actually work?
The software never checked which website was talking to it. That single missing check is where everything fell apart.
When you install Connective, it runs quietly in the background, ready to help any website that needs to confirm your identity or collect your signature. The problem: it would respond to any website, not just legitimate ones. A criminal could build a fake page, or hide malicious code inside an online advertisement on an otherwise normal site, and that code could silently read the details from your ID card or payment card the moment you plugged it in.
Worse, the software let websites display official-looking pop-up boxes asking for your PIN, the four-digit code that protects your electronic signature. Those pop-ups showed whatever text the requesting website chose. Nothing on screen told you which site was actually asking. So a fake banking page could show a pop-up that looked completely genuine, you'd type your PIN, and the attacker's server would receive it.
| What was at risk | Detail |
|---|---|
| Electronic ID card data | Silently readable by any site while card was inserted |
| Payment card details | Also exposed via the same missing check |
| PIN code | Could be harvested through fake-but-convincing pop-ups |
| Electronic signatures | Attackers could forge legally binding signatures using a stolen PIN |
| Computer itself | Remote code execution flaw worked even without a card present |
With a stolen PIN, an attacker could generate what are called approval tokens, digital proofs used to create a legally binding electronic signature, without the card owner knowing. Forged contracts, forged government filings: all possible. Accounts on services like the national identity platform CSAM.be and the widely used Itsme identity app were also at risk of being hijacked. Neither of those services had flaws of their own; they simply trusted the signature, and the signature had been faked.
Could your computer be taken over too?
Yes, and this part did not even require an ID card. Arnott also found a remote code execution vulnerability, meaning a way to force the software to run attacker-controlled instructions on your machine. A criminal could pull it off by getting you to download a file that looked like an ordinary document and then visit a webpage. No admin password required. The flaw also had worm-like potential: it could hijack your credentials to forward malicious links to your contacts.
In practice, the failure mode is a drive-by attack. You open what looks like a PDF. The attacker is already running code under your account.
What has been fixed, and what should you do?
Nitro Software Belgium patched everything. Enforcement completed in late July 2025, 146 days after Arnott's first report. Updates block requests from unauthorised sources and secure how PINs are handled. No CVE identifiers, the standard reference numbers used to track publicly known software vulnerabilities, appear to have been assigned. Nitro did not respond to a request for comment first reported by SecurityWeek.
If you're a Connective user in Belgium, check your browser's extension list now and apply any pending updates. Watch any accounts tied to your national ID, including government portals and banking apps, for unexpected login activity or documents you don't recognise.
Should you worry about the $200 bounty?
Yes. A $200 payout for flaws that touched the signing infrastructure of an entire country's digital economy is an awkward number to defend in a post-mortem. It also has no CVEs attached, which means no standard tracking, no automatic scanner alerts, no CVSS score for procurement teams to act on. Our earlier report on the Bendix EC-80 brake controller recall, published 7 August 2026, showed a similar pattern: a security fix buried inside a process designed for something else entirely. The common thread is infrastructure that people trust implicitly, quietly patched, with the public none the wiser until a researcher shows up at a conference.
