They are apparently onto the VM trick now. I've heard of them checking the running processes for the virtualized network connection, etc.