Latest8 out of 10 Banks in Belgium HATE This One Weird eID RCE

Find out what isspying on you

Search for problematic browser extensions across your fleet.

Our Findings

Our research, covered by

DKCERT

Read the code, not the manifest

We find problems no one else does because we don't just have a static scanner which looks for known patterns.
We read what the code actually does, every line.

This is how:

On the Belgium CCB Wall of Fame 2026 for responsible disclosure
Caught Stylish (2m users) exfiltrating
every URL and AI chat content
Disclosed a CVSS 8.3 in a password manager
with over 1m users leaking credentials
Found Urban VPN's extension taking
commands from any website

Deobfuscation

Stylish hid behind 4 layers of base64 + AES-256-CBC + a columnar transposition cipher.
We unwrapped all of it.

Re-analysed on every update

Cyberhaven's attackers didn't change permissions, they changed code. We rescan every release, so a trusted extension can't quietly pivot into a stealer.

Novel-attack detection

LLM pipeline catches what no signature has seen: encoded payloads assembled at runtime, weird egress, page leaks.

Instrumented sandbox

An agent drives the extension like a real user, with aged accounts to trigger gated behavior.

Network egress capture

Every outbound request, traced live

We don't miss the 1 in 1000 that will cause you major problems.

Layered defence. Every finding survives cross-examination before it ever reaches you.

Recently flagged by us

Recent findings.

Threat Intelligence Feed

Plug our intel into your SOC.

Every confirmed finding, malware in silent updates and vulnerabilities in trusted extensions, published as machine-readable threat intel your stack can ingest.

Explore the feed

STIX 2.1 native

Indicators, malware, and relationship objects straight from the spec. No proprietary schema to map.

Mapped to MITRE ATT&CK

Every object carries technique and CWE IDs, so findings drop straight into your existing detections.

// One object from the collection

{

"type": "indicator",

"spec_version": "2.1",

"name": "Credential exfiltration via hooked fetch",

"labels": ["malware"],

"x_aibp_severity": "critical",

"x_aibp_extension": "fjnbnpbm…@3.1.2",

"x_mitre_attack": ["T1056", "T1119"]

}

Works with
every popular browser

The pipeline

From every store to a claim you can audit.

How it works

Chrome Web Store

315K extensions

Edge Add-ons

30K extensions

Safari Extensions

12K extensions

Static Analysis

Agents read the bundle before it ever runs. Manifest, code and supply chain.

manifest.json · host_permissions · code-bundle · npm-tree · signing-cert

Dynamic Analysis

Detonated in a sandboxed browser. Every call, request and write is traced.

network.trace · dom.access · storage.io · eval.calls · exfil.detect

Agentic Verification

Multiple agents cross-check findings and reconcile them into a single claim with cited evidence.

cross-ref · dedupe · evidence-link · severity-score

c-47291·Critical

Exfiltrates all URLs in real time

8M Users

c-47263·High

Trusts main world in cryptographic operations

2M Users

c-47218·Low

Scoped to single host, no telemetry

700k Users

Latest research.

Deep-dives on the extensions, vendors, and attack patterns our pipeline surfaced.

View all posts

8 out of 10 Banks in Belgium HATE This One Weird eID RCE

The Connective signing extension, used by 8 of the 10 largest banks in Belgium and 60+ government agencies, let any website read your eID and Maestro cards, recover your eID PIN, and trigger a drive-by RCE. All the victim sees is a file download.

7 August 2026Read post