I actually consider the Sony BMG rootkit as the beginning of commercial malware. The antivirus companies knew it existed, but did not flag it partially because it was by a legitimate company with a legal department, and not an unknown developer or dubious organization like viruses up to that point.

> The antivirus companies knew it existed, but did not flag it partially because it was by a legitimate company

Just like Google today with play protect. From this point of view, Sony was a pioneer. /s