From “can it be done” to “who is affected”
The first programs that copied themselves were not threats in any ordinary sense. They were answers to the question of whether it could be done. What changed over the next two decades was not mainly the technology, which stayed fairly simple for a long time, but the reasons people had for writing and releasing such programs and the number of people who relied on computers and so could be affected.
Curiosity and experiment
The earliest cases came from researchers. The Creeper program, in the early 1970s, was an experiment on a research network, and the worm programs built at Xerox’s lab were meant to use idle computers for useful work. Fred Cohen’s 1983 demonstrations were deliberate studies with permission from the system’s owners. The word “threat” would have been strange to these authors. They discovered risk almost by accident, when programs behaved in ways nobody had intended.
Pranks and showing off
Once personal computers were common, teenagers and hobbyists could write programs of their own. Elk Cloner, written in 1982, displayed a poem on certain startups. Many programs of the following years displayed messages, played tunes or made letters fall to the bottom of the screen. The aim was attention, or to show skill, or simply to see how far the program would travel.
These viruses were not necessarily harmless. A prank that rewrites system areas can still lose data, and a user who has just discovered strange messages on a machine does not know how it will end. Some authors also said afterwards that they had not expected the result. The Morris worm of 1988 is the standard example: its author said he wanted to measure the size of the network, but a flaw made it keep reinfecting computers until they became unusable. The harm came from a bug, not from malice.
Vandalism and protest
Not everyone was playful. By 1987 there were viruses designed to destroy files on a particular date. The Jerusalem virus, found that year, was reported to delete programs on Friday the 13th, and others overwrote disks or corrupted spreadsheets. Some were presented as political statements or as revenge against an employer. Virus writers also formed informal groups that traded code and competed for notoriety, which increased the number of new viruses. Some of the media coverage of the period, such as the alarm around a virus set to trigger in March 1992, now looks exaggerated, but it did bring the subject to ordinary people.
Software protection and piracy
One early motive was less destructive: to discourage copying. The Brain virus of 1986 is attributed to two brothers who ran a computer shop in Pakistan, and they have said it was aimed at people who pirated their software. It was not designed to destroy data, but it showed that a program could act as a kind of tracking device that spread with every illegal copy. That mixture, a punishment for people who break rules, did not become a widespread approach, but it raised the question of whether a self-spreading program could ever be justified, a question most security professionals would answer no.
Organizations start counting costs
As computers moved into offices, viruses stopped being an annoyance for individuals and began to affect work. Companies in the late 1980s and early 1990s found that an infection on one workstation could pass to every shared disk in a department. Cleaning up meant staff time, and sometimes lost data. This was the period when security software started to sell to businesses, when companies wrote rules about outside disks, and when “malware threats” became a line in a risk register. Estimates of the total cost of particular outbreaks are published from time to time, but they are rough guesses and should be read with caution.
Money enters
Around 1989 a trojan program was mailed on disks to participants at a medical conference. It encrypted file names and demanded payment to an overseas address. Because it was clumsy and the money trail was easy to follow, it did not start a trend. Two decades later conditions were different: widespread broadband, online banking and a payment system that could be abused made crime profitable. From the mid-2000s, networks of compromised computers were used to send spam, commit fraud and attack websites, and malware was sold to people with little technical skill. Ransomware, which encrypts files and asks for payment, grew into a major criminal activity.
States and strategic targets
In 2010, researchers published an analysis of Stuxnet, a worm that reportedly looked for specific industrial control equipment. Governments have been widely reported to be behind it, though official confirmations are limited. Since then, espionage and sabotage involving malware have been regular features of international news, and the subject appears in defense policy. The targets have also widened, from office PCs to smartphones, cloud computing accounts and connected sensors in factories.
Why the shift in motives matters
Each change in motive changed the defense. Pranksters want attention, so their programs announce themselves. Criminals want to stay hidden for as long as possible, so modern malware tries to avoid being seen. A defense designed for the first group, such as looking for a visible symptom, does little against the second. That is why the answer to “what was the first virus?” matters less than the history of why viruses were written, because it explains why the threat has continued to adapt.