My favourite story of this is that ransomware virus that was taking out places like the NHS, and some security researcher noticed it kept pinging some domain that was a random bunch of characters.

He registered the domain, and suddenly the ransomware shut down, freeing all the places the ransomware had infected.

It turns out when researching a virus the environments commonly treat all domains as valid so they can capture the traffic and see what the virus is doing. To prevent this, the ransomware was designed to shut down if this clearly fake domain came back as valid (and I guess this was the release switch if the ransom was paid). That was it would shut down if in this kind of a sandboxed environment.

The story is here, written by the researcher so it's a bit technical. There were lots of news stories about it at the time too.

You sitting on some hypervisor zero days worth fucking millions over here to infect some idiot trying to run GTA6?

I somewhat doubt the malware devs chucking their probably pirated copy of some cred stealer have implemented some zero day VM breakout exploit lol.