content: It's been done several times. I don't recall specific instances, but typically they'll infect a pc via a vulnerability, then patch that vulnerability away once they're in. Now, this behavior is NOT just white hat stuff. sometimes malware will do this to prevent competing malware from exploiting the servers they just compromised.