By Ax Sharma April 4, 2023 05:00 AM
If it was not already bad enough with the Banking issues going on
Note, this security incident specifically concerns eFile.com and not IRS’ e-file infrastructure or identical sounding domains.
Just in time for tax season
eFile.com serving malicious popper.js file
The ‘popper.js’ file used by eFile.com across its webpages contains malware
The development comes at a crucial time when U.S. taxpayers are wrapping up their IRS tax returns before the April 18th due date.
The use of Math.random() at the end is likely to prevent caching and load a fresh copy of the malware—should the threat actor make any changes to it, every time eFile.com is visited. At the time of writing, the endpoint was no longer up.
eFile.com pages serving popper.js
eFile.com pages serving poppers.js (BleepingComputer)
As of today, the file is no longer seen serving the malicious code.
Website ‘hijacked’ over 2 weeks ago
On March 17th, a Reddit thread surfaced where multiple eFile.com users suspected the website was “hijacked.”
At the time, the website showed an SSL error message that, some suspected, was fake and indicative of a hack:
Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”