ANIMAL trojan replicated across mainframes

ANIMAL began in April 1974 as a guessing game for UNIVAC 1100 systems. The game learned from players, corrected its own animal tree, and was popular enough that users asked John Walker for copies, which he answered by writing magnetic tapes and mailing them out. In January 1975 Walker added a general purpose subroutine called PERVADE to solve distribution by automation: while the game ran, PERVADE examined directories writable by the current user and copied the current program into places where no copy, or only an older copy, existed.

That made ANIMAL less a prank than an early supply-chain lesson. The useful program was also the distribution mechanism. There was no separate installer, updater, or exploit kit; every trusted run could become a copy operation into another trusted location.

The code did not exploit an operating-system bug. It used normal access and shared directories. When a privileged user ran it, ANIMAL could reach system libraries, and when users exchanged tapes, the program moved between installations.

The payload was benign, but the lesson was not. ANIMAL showed that a useful program could carry quiet replication logic, cross trust boundaries through ordinary use, and spread faster than policy could reason about it.