A virus that infected Delphi itself, then everything Delphi built

In August 2009 antivirus vendors started flagging popular Windows utilities as infected, and the vendors of those utilities insisted their code was clean. Both were right.

The virus, W32/Induc-A, did not target the applications. On a machine it reached, it looked for a Delphi installation, and if it found one it wrote malicious source into SysConst.pas, compiled that to SysConst.dcu, and moved the original aside as SysConst.bak. SysConst is a unit almost every Delphi program links. From then on, every application compiled on that machine embedded the virus, and the developer's own source code contained nothing unusual at all.

That made the developers themselves the distribution channel. Sophos collected over 3,000 distinct infected programs from the wild, and ESET counted more than four thousand samples by 19 August. Users caught it by downloading ordinary Delphi software: the chat client QIP, the media player AIMP, Tidy Favorites, Any TV Free. The vendors had shipped it without knowing, because their build machines had been infected first.

Induc carried no payload beyond spreading. No botnet, no theft, nothing destructive — which is why it circulated undetected for months, and also why it reads today as a demonstration rather than a crime. It is the Thompson compiler attack occurring in the wild, at a smaller scale than XcodeGhost six years later and with a mechanism a reader can hold in their head: infect the compiler's standard unit, and the compiler does the rest.