1. A method for detecting covert malware in a computing environment, the method comprising: receiving, using a hardware processor, a first set of user actions; automatically generating, without receiving user input, using the hardware processor, a second set of user actions that is similar to the first set of user actions based on the first set of user actions and using a model of user activity, wherein the first set of user actions is modified using the model of user activity to generate the second set of user actions in the form of simulated user actions; replaying, using the hardware processor, the second set of user actions to an application inside the computing environment; determining, using the hardware processor, whether state information of the application matches an expected state in response to the second set of user actions is being replayed to the application inside the computing environment; determining, using the hardware processor, whether covert malware is present in the computing environment based at least in part on the determination of whether the state information matches the expected state; and transmitting, using the hardware processor, an alert to a computing device in response to determining that covert malware is present in the computing environment.