Loading malware…
Scores is a Macintosh computer virus first discovered in Spring 1988 that affected Apple Macintosh systems running System 6 and System 7. It is also referred to in the provided content by the aliases Eric Vult and NASA San Jose Flu. The malware infects key system files including System, Notepad, and Scrapbook; blank document icons for Notepad and Scrapbook are noted as an indicator of infection. Two days after infection it spreads to additional components including the Finder and DA Handler. Its staged payloads activate over time: after four days, it causes crashes when programs bearing the "ERIC" or "VULT" signatures are run; those signatures are stated to be associated with software written by Electronic Data Systems (EDS) of Plano, Texas. If such an EDS program is run, the system may crash after 25 minutes. After seven days, Scores attempts to prevent programs with the "VULT" signature from writing to disk, and if no disk writes occur within 10 minutes under those conditions, it crashes the system. The content states it allegedly was written by a disgruntled programmer to attack two unreleased applications under development at a former employer. It reportedly spread through an electronic bulletin board run by an Apple dealer supplying personal computers to the U.S. government. Infections were reported on Macintosh systems at NASA and in several congressional offices. Reported effects included some data loss, slower system operation, and difficulty using some programs and printers. The alleged author was reportedly questioned by the FBI but could not be charged under then-existing federal law; the incident is described as contributing to the Computer Virus Eradication Act of 1988. A Microsoft detection name cited in the content is Virus:MacOS/Scores.A.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named 1980s-era malware (listed as part of a historical timeline). No behavior details provided in the content.
Computer virus (only referenced by name in the 1980s malware timeline; no additional details provided).
A Macintosh-related virus that spread via an electronic bulletin board, causing some data loss, operational slowdown, and difficulty using some programs and printers.
Hacking in the 1980s ... Malware ... SCA ... Scores ... Stoned
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.