Plenty of malware refuses to run inside a virtual machine — so why not run everything in one?

The reasoning breaks at the assumption that this behaviour is a property of malware. It is a property of a strategy, and strategies respond to what defenders do.

The reason some families check for virtual environments is that a virtual machine used to be strong evidence of an analyst's sandbox rather than a real target. Refusing to run avoided being studied, at the cost of skipping a few real victims — a good trade when virtual machines were rare.

The moment ordinary users are all in virtual machines, that trade inverts. Skipping virtual environments would mean skipping everyone, and the check would be removed in a week. You cannot build a defence out of your adversary's cost calculation when your defence is what changes the calculation.

This is the general shape of the objection, and it applies to a lot of clever inversions of attacker behaviour.

Something quite close to your idea is practised, though, and it is worth knowing about because the framing is different.

The real technique is disposability, not detection avoidance. Run a browsing or document-opening environment that is rebuilt from a clean image every session, so anything that gets in has a lifetime measured in hours and no access to anything persistent.

That is how public access terminals are usually run — boot from a network image, keep no writable local disk, discard everything at reboot. Some security-focused desktop systems apply the same principle per application, giving each one its own compartment.

Note the difference from your proposal: it does not rely on malware choosing not to run. It assumes malware does run, and makes that fact stop mattering. Defences built on the second assumption survive contact with an adaptive adversary; ones built on the first do not.

Two more practical breaks, both of which matter independently:

Most malware does not check. Detection logic is only present in a minority of samples — mainly the ones whose authors expect analysis. Commodity ransomware, credential stealers and browser-based attacks largely do not care, and those are what actually reaches people.

The valuable things are inside the virtual machine with you. This is the bigger point. If you do your work in a virtual machine, then your documents, your browser sessions, your saved passwords and your network access are all in there too. Malware that runs inside it has everything it wanted. Isolation from the host protects the host; it does not protect the data you put in the guest.

People imagine the virtual machine as a shield around them, when it is a wall around a room they are standing in.

One more wrinkle: the boundary itself is not free. Virtualisation escapes are rare but they exist, and every hypervisor has had some.

So a virtual machine is a good boundary, not a perfect one, and stacking your entire security posture on it means a single class of vulnerability collapses everything. Which is a general argument for defence in depth rather than against virtualisation — but it is worth stating whenever somebody proposes one mechanism as the answer.