About 20% between 2012 and 2014 [1], I actually believe it was much more earlier when few used VMs for production. That meant that a virus could assume that if

About 20% between 2012 and 2014 [1], I actually believe it was much more earlier when few used VMs for production. That meant that a virus could assume that if it were executing in a VM context they were being monitored and altered their behavior to either play nice or distract. Nowadays a VM target could be just as valuable as any other. [1] https://www.symantec.com/connect/blogs/does-malware-still-detect-virtual-machines https://www.symantec.com/connect/blogs/does-malware-still-de...