A malicious URL detection method, apparatus, and storage medium are provided. The method includes rolling back a virtual machine to an initiating state in response to detecting a trigger event of the virtual machine. In the initiating state, page content of a target URL is loaded using the virtual machine. Using the virtual machine, an application program linked to the page content is run. A system snapshot file of the virtual machine is obtained in at least one state of the initiating state, a state in which the loading of the page content is completed, or a state in which the application program is being run. Malicious URL detection is performed on the target URL based on the obtained system snapshot file.