The Trickbot gang is once again doing a screen resolution check to identify virtual machines before deploying payloads, and hence trying to stay under the radar with its improved techniques. Experts say it is for the first time that a gang is using a script in an HTML attachment to check for screen resolution. Organizations should have a tool that can examine files based on their behavior and deliver reports on important system changes.