Compromised eFile.com JavaScript distributes malicious browser-update payloads to tax-filing users

By March 17, 2023, the legitimate eFile.com tax-preparation website was serving a maliciously modified JavaScript component, identified as popper.js, across much of its web application. Researchers confirmed that the altered script loaded attacker-controlled resources and could redirect visitors to a fabricated browser security error requesting installation of a supposed browser update. The offered executables contained malicious functionality, turning the trusted tax-filing platform into a delivery mechanism for attacker-controlled software. This constitutes a documented compromise of legitimate software content distributed through the service's normal delivery channel and an integrity impact on software consumed by downstream users. Confirmed downstream device infections or customer operational shutdowns were not established.