Project file infection is the tampering of stored PLC engineering files, such as logic, configuration, or project archives, so the altered content may later be downloaded or deployed to a controller. The attacker does not need to change the live PLC immediately; changing the saved project can be enough to make the malicious or faulty behavior appear during the next maintenance cycle or upload.
This matters because PLC project files are a trusted source of truth for industrial operations. If they are modified, defenders may unknowingly reintroduce unsafe logic, disable protections, or restore compromised settings after repairs. In real attacks, this can be paired with HMI or SCADA manipulation to hide the change from operators. Defenses include strict access control for engineering workstations, file integrity monitoring, versioned backups, signed or hashed project files, and review of any unexpected logic or configuration changes before deployment.