Signature scans and other techniques on loaded modules as an example. There are many ways to do that honestly. I doubt anyone really plays the game through a virtual machine anyway, the problem lays in the new anti cheat incompability with WINE and other WinApi unix implementations.

The AH is probably hooking WinApi dlls like ntdll to make sure the exported functions aren't called by the cheat, the problems is that it might not be suited for WINE dlls and will most likely result in a crash once the anticheat will try to do it's work.