Techniques are described for preventing a software module from executing in an unauthorized environment. A software module may be configured to collect context information that describes an environment in which the software module is executing. If the context information indicates that the environment is unauthorized for executing the software module, the software module may alter its behavior(s) or its binary signature to simulate a threat. Threat detection module(s), such as anti-virus software, anti-malware software, and so forth, may then identify the software module as a threat and disable its execution or perform other actions. In some cases, the analysis of the context information may be performed on server device(s), which may send a signal to cause the software module to alter its behavior(s) or its binary signature.