Hackers Dodging Security Tools by Dropping Secret QEMU Virtual Machines Inside Windows

2026-04-20

Sophos warns of two active campaigns where attackers use QEMU to deploy stealthy Alpine Linux virtual machines within Windows. This technique hides malware from Windows Defender and other security tools, allowing evasion of detection.