There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make everything a VM? Now all systems are safe!

I know not all malware does this but considering that there are many cloud services these days that run on VMs in remote servers does that mean that they are all immune to these types of malware?

I am aware that not all cybersecurity threats involve malware but the focus of this question is mainly on malware attacks.