I Can Has Undetectable Malware?

from here

Inspired by a tweet by Mikko Hypponen suggesting this actually happened with a recent targeted attack.

It's certainly something that does happen, and the more sophisticated attackers long ago figured out they needed to use a service that doesn't send their test samples to their adversaries. Always nice when attackers fail to think things through, though.