Skip to content

Anti-VM / sandbox evasion

Named by 2 kept items in this workspace.

Search every workspace for Anti-VM / sandbox evasion. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
    writeup2026-09-28It is written here as Anti-VM / sandbox evasion (T1497).

    Checks CPU vendor strings and a long list of VMware, VirtualBox, Hyper-V, QEMU, Xen and Parallels drivers/services; also uses hardware fingerprinting; V2 adds a sandbox check that opens a harmless window if a helper call fails.

  • How Fake OpenClaw Installers Spread GhostSocks Malware
    writeup2026-03-04It is written here as AntiVM / sandbox evasion.

    Stealth Packer performs checks for mouse movement to detect virtual machine/sandbox environments before executing decrypted payloads

All techniques in this workspace.