Supply Chain Compromise or False Positive: The Intriguing Case of efile.com, (Mon, Apr 3rd)

Last week, related to the 3CX compromise, I mentioned how difficult it can be to determine if an overall trusted resource is compromised. This weekend, our reader Drew sent us a note that there is some talk about efile.com being possibly compromised. Users are reporting a popup that offers a file “update.exe.” This in itself is, of course, highly suspicious. But I was not able to reproduce the issue. Drew also linked to an any.run analysis showing the behavior [1]. …

3cx analysis any.run case compromise compromised course efile.com false positive popup reader reporting run supply supply chain supply chain compromise update weekend