Technologies for handling malicious activity of a virtual network driver include a network computing device on which a virtual machine is being executed and the virtual network driver is managing communication between the physical network interface controller and the virtual function network adapter. The network computing device is configured to monitor events handled by the virtual network driver to detect malicious activity and update one or more malicious event tracking variables corresponding to a type of malicious activity event detected. The network computing device is further configured to compare one or more of the malicious event tracking variables to a corresponding malicious event threshold and perform an action on the virtual function driver in response to a determination that one or more of the malicious event tracking variables indicates that the corresponding malicious event threshold has been violated. Other embodiments are described and claimed herein.