What type of virus is most likely to remain undetected by antivirus software?

A cavity (space-filler) virus inserts itself into unused regions of a file without altering the file size, which reduces detection cues but does not actively deceive antivirus scanning routines the way a stealth virus does.

A stealth virus hooks into OS interrupt handlers and system calls - such as file read operations - to intercept AV queries and return falsified data showing the file in its original, uninfected state. This active deception subverts the core inspection mechanisms that antivirus tools rely on, effectively hiding both the virus's code and any changes it has made to infected files or the boot sector.

A file-extension virus manipulates file extensions to execute malicious code, a technique that is well-covered by both signature-based detection and heuristic analysis in modern antivirus software.

A macro virus embeds malicious macro code inside documents such as Word or Excel files and is widely detected because its macro-based payload patterns are thoroughly documented in AV signature databases.