Here are a couple of very recent ISC SANS posts on the issue:

Supply Chain Compromise or False Positive: The Intriguing Case of efile.com [updated - confirmed malicious code] - https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+...

Analyzing the efile.com Malware "efail" - https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+ef...

edit: Of course I rushed to post this comment before actually looking at the linked story. The story links and credits one of these posts.