The ILOVEYOU worm (2000)

What happened

In early May 2000, people around the world opened their email to find a message with the subject line "ILOVEYOU" and a short note asking them to read the attached love letter from the sender. Because the message usually came from someone they knew, many opened it. The attachment was a small script, and once it ran it emailed itself to everyone in the victim's address book. Within roughly a day it had reached offices, newsrooms and public bodies across Asia, Europe and North America.

The worm was traced to the Philippines. Investigators identified a young computer student as its likely author, but charges were dropped because the Philippines had no law against writing malware at the time. The country passed an electronic commerce law covering such acts shortly afterwards.

How it worked

ILOVEYOU combined a clever trick with a few Windows defaults of the era:

• A disguised file name. The attachment was named LOVE-LETTER-FOR-YOU.TXT.vbs. Windows hid known file extensions by default, so many users saw only LOVE-LETTER-FOR-YOU.TXT and assumed it was a harmless text file. It was actually a VBScript program.
• Scripts ran on double-click. Windows Script Host executed .vbs files directly, with the user's full permissions.
• Mass mailing through Outlook. The script used Microsoft Outlook's automation features to send copies to every contact, so each new message arrived from a trusted sender.
• Destructive file changes. It overwrote many files, such as images and some media and document types, with copies of itself, which destroyed the originals for people without backups. It also tried to download a password-stealing program.

Variants with different subject lines appeared within days as others copied and modified the script.

Impact

Estimates suggested tens of millions of computers received or were affected by the worm. Many organizations shut down their email systems for hours or days to stop the spread. Damage estimates in the billions of dollars were widely reported, though such figures are hard to verify. What is certain is that it was one of the fastest-spreading and most disruptive malware events up to that time.

What defenders learned

• People are the attack surface. ILOVEYOU did not exploit a software bug. It exploited curiosity and trust in a familiar sender. That insight underpins modern phishing training.
• Hidden extensions are dangerous. Showing full file names became standard security advice, and email providers began blocking script attachments outright.
• Automation needs limits. Microsoft later added security prompts when programs tried to send mail on a user's behalf through Outlook.
• Laws must cover computer misuse. The case pushed several countries to update cybercrime legislation.

What it means for you

The same psychology drives today's phishing: a message from someone you know, an emotional hook, and an attachment or link that looks harmless. Modern versions use shared-document notifications, invoices or delivery notices instead of love letters.

Practical habits:

• Turn on "show file extensions" in Windows File Explorer (View, then Show, then File name extensions) and on macOS in Finder settings.
• Be wary of unexpected attachments, even from friends. Ask them through another channel if they meant to send it.
• Be very suspicious of attachments ending in .vbs, .js, .exe, .scr, .iso, .lnk or Office files that ask you to "enable content".
• If unsure, check the file with the tools in our suspicious link and file guide before opening it.
• Keep backups, because destructive malware is still around.