A virtual machine looks, to the user, like a clean separate computer. To an anti-cheat it often looks like a giant warning sign — and many simply refuse to run inside one.
Why VMs are flagged
Cheaters have used virtual machines to isolate cheat tools or to escape hardware bans by presenting fresh virtual identifiers. Anti-cheat vendors responded by detecting the VM itself: if the environment is virtual, the game may refuse to launch regardless of what is inside it.
The CPU tells on the VM
Modern processors expose a "hypervisor present" flag through the CPUID instruction. When software runs on bare metal that bit is clear; inside a VM it is usually set. This is one of the fastest and most reliable VM checks an anti-cheat can make.
Virtual hardware has tell-tale names
Virtual machines emulate hardware, and that hardware carries recognisable names. Disk controllers, network adapters and graphics devices from VMware, VirtualBox or Hyper-V identify themselves in ways that do not appear on physical PCs. MAC address ranges are assigned to virtualisation vendors. Registry keys, driver names and system manufacturer strings all leak the same fact.
Timing and behaviour
Some checks are subtler. Certain operations behave with slightly different timing under virtualisation, and some low-level instructions return results that differ from bare metal. Anti-cheats combine several of these weak signals into a confident verdict.
The takeaway
Detecting a virtual machine is, for an anti-cheat, much easier than detecting a clever cheat — the VM advertises itself through CPU flags, device names and timing. That is why "just run the game in a VM" rarely works against a serious anti-cheat: the environment is spotted before the game even starts.