Kavra LabHow a virtual machine works
A program called a hypervisor divides one physical computer into several virtual ones. Each VM gets a share of the processor and memory, a virtual disk stored as a file, a virtual graphics adapter and a virtual network card. The operating system inside, Windows, Linux or another, behaves as if it were on its own hardware. Well-known hypervisors include VMware, VirtualBox, Hyper-V, KVM and the systems behind every major cloud provider.
Because a VM's whole state lives in files, it can be saved as a snapshot and restored to that exact point, copied a hundred times, or started in a cloud data center and deleted an hour later. Those properties make VMs essential for IT and software testing, and very convenient for anyone who wants many clean computers.
How virtual machines are used in fraud
For a fraud operator, a VM is a cheap, disposable device. Set up one Windows image with a browser and scripts, snapshot it, then restore it before each new account so no cookies, files or history carry over. Change the virtual hardware settings and the next session reports a different machine. Run dozens side by side on one server, or rent them by the hour in the cloud.
VMs are common in fake account creation, free-trial and credit abuse, click and ad fraud, and as hosts for headless browsers and bot farms. They are often combined with an antidetect browser inside the VM and a proxy outside it, so the device, browser and network all look new each time.
Virtual machine vs real computer
Real computer
- Named graphics card with real drivers
- Years of installed software and fonts
- Hardware clock and timing with natural jitter
- Connects from a home, office or mobile network
Virtual machine
- Generic virtual display or software rendering
- Clean, minimal install restored from a snapshot
- Timing shaped by a hypervisor sharing the host
- Often connects from a cloud or hosting network
Where VMs are normal and where they are a warning
| Context | VM traffic is | Why |
|---|---|---|
| Corporate virtual desktops | Normal | Employees work on hosted Windows desktops |
| QA and accessibility testing | Normal | Testers check sites on many systems |
| Developers and security researchers | Normal | Sandboxed environments by design |
| Consumer signup with a reward | A warning | Disposable devices reset between accounts |
| Repeated trials on one product | A warning | Snapshots erase every trace of the last trial |
| Payments from a new device | A warning, weigh with other signals | Card testing often runs in VMs |
How to detect virtual machines
A VM rarely says it is a VM, and good fraud setups hide the default names. It still leaves physical traces: graphics that render in software or through a generic virtual adapter, hardware values that do not fit the claimed machine, timing patterns shaped by the hypervisor, and a network that belongs to a hosting provider. Because remote workers use VMs honestly, a VM should raise attention, not trigger a block by itself. Kavra detects virtual environments as part of its device and environment layer and weighs them with network, behavior and account links. See virtual machine detection.