Aldus FreeHand disk shipped MacMag virus

Aldus FreeHand is one of the earliest clean examples of commercial software media carrying malware. The affected artifact was the shipping retail product, not a promotional giveaway. The virus reached Aldus on a training disk delivered by MacroMind, a subcontractor, and moved from there into the FreeHand masters that a duplicating machine copied for three days. Half of those disks went out to retail outlets before the rest were caught in the warehouse. That physical path matters. The user did not download a suspicious utility or accept a shareware copy. The disk arrived shrink-wrapped from the publisher, so the trust decision had already been made by the publisher's duplication process.

The malware was MacMag, also known as Drew, Brandow, Aldus, Peace, or World Peace. It targeted classic Macintosh systems, copied itself through the System folder path, and spread to bootable disks opened on an infected machine. Its intended behavior on March 2, 1988 was to display a "Universal Message of Peace" and then delete itself.

The payload was meant as nuisance and publicity, but bugs and context made it more serious. Public summaries describe crashes on some Mac II systems, possible accidental deletion in narrow cases, and broad user anxiety. Aldus had to recall or rework thousands of FreeHand packages and threatened legal action after its media became a carrier. MacroMind's client list also included Microsoft, Lotus, Apple, and Ashton-Tate, so the scare ran wider than one product; Microsoft and Lotus said none of their software was infected.

This record is kept in scope because the malware moved through official commercial product media. It was not a random infected user disk; it was a contaminated master copied into a legitimate distribution channel.