Cybercriminals are using AI-enhanced “antidetect” browsers to operate vast networks of fake accounts while making each profile look like it belongs to a different person, device, or location.
Researchers at Check Point Research say these tools allow a single operator or a small team to manage thousands of accounts across social platforms and other services, making it harder for those services to spot connections between accounts.
Although antidetect browsers have legitimate uses, Check Point documented their presence on criminal forums and marketplaces and described how they are used in fraud and account-takeover schemes.
Analysts identified Kameleo, AdsPower, and MultiLogin as three commercial products that include features enabling this behavior.
Their October 20, 2026 report explains that these platforms combine profile isolation and identity-masking capabilities with automation and, in some cases, AI integrations.
The report does not label the browsers as malware; instead it warns that commercially available software can be abused by criminals to hide coordinated operations.
How the browsers evade detection
Websites can collect many details about a browser and device—screen size, time zone, language, user agent string, graphics settings, and more—that together form a browser fingerprint. Services often compare fingerprints and activity patterns to find accounts that appear to share a device or operator.
Check Point says antidetect browsers can alter or assign different values for those indicators, making it harder to link profiles to the same operator or device.
These tools also isolate cookies, local storage, and session data for each profile. Many support proxy services so each profile can appear to connect from a different network location.
That can defeat checks based only on IP address or geographic location. Prior coverage has shown how residential proxies can mask malicious traffic, though proxy use by itself is not proof of criminal intent.
A more serious danger arises when attackers use stolen session cookies. A session cookie can keep a user logged in; if stolen and reused, it lets an attacker access an active account without re-entering credentials.
Check Point says criminals can inject stolen session data into a browser profile so the session looks legitimate to the service. This method relates to session-cookie theft and account takeover, where access to an authenticated session can bypass protections focused on initial sign-in.
AI and automation let abuse scale
The report notes that AI features and automation reduce the manual effort needed to run many accounts. AdsPower, for example, advertises an MCP (Model Context Protocol) server to link large language models with browser profiles.
Researchers describe a workflow in which AI-generated content is combined with automated account actions and distribution. While not every customer of these products is committing abuse, the combination makes it easier to scale coordinated misuse.
Some platforms offer templates for repetitive actions and tools to build activity histories over time. This “warming” process can make a new profile look like an established account rather than a recently created one.
Check Point warns that such profiles can accrue credible histories or pass identity checks, delaying detection until fraud begins.
Possible abuses include account takeover, payment fraud, fake loan applications, ad fraud, phishing, malware distribution, and coordinated attempts to influence online discussion.
Organizations are also at risk if staff or customer accounts are targeted. A stolen session can be used to reach email, financial services, or other systems tied to the compromised account.
Related reporting on Microsoft 365 session theft after MFA shows why security teams must monitor active sessions, not only passwords and multi-factor challenges.
Check Point recommends that defenders look beyond per-account signals, because antidetect tools are built to make individual profiles appear unrelated.
Security teams should examine network and infrastructure indicators, including large-scale residential-proxy use, abrupt or unusual browser-fingerprint changes, and suspicious cookie-injection or pre-authenticated-session patterns. Organizations should verify that session monitoring can detect unexpected access to already authenticated accounts.
For platforms, account-level signals remain useful but should be combined with infrastructure analysis and cross-profile investigations. For companies, security reviews should cover cases where a valid session is used from an unexpected device or network—even when no new password is requested.
As with other session-hijacking techniques, invalidating active sessions may be necessary when an account is confirmed compromised. Antidetect browsers are not a single malware family with one signature; they are tools that mask identity signals, and when paired with automation and AI they enable abuse at scale. Defenders therefore need to connect signals across accounts, devices, networks, and sessions instead of relying on any single indicator.
Indicators of compromise (IoCs)
| IoC type | Indicator from the source | Notes |
|---|---|---|
| SHA-256 / file hash | Not provided | The report discusses commercial browser tools and their misuse, not a specific malware sample. |
| Domain or IP address | Not provided | No campaign infrastructure is listed as an IoC. |
| Detection signals | High-volume residential proxy activity; unusual fingerprint changes; suspicious cookie-injection or pre-authenticated-session patterns | Treat these as investigative leads rather than definitive proof of compromise. |
Note: IP addresses and domains in threat reports are often intentionally defanged (for example, with “[.]”) to prevent accidental resolution or linking. Re-fang only within controlled threat-intelligence environments such as MISP, VirusTotal, or your SIEM.
Update defenses against new threats as they appear. Integrate threat-intelligence feeds with data from SOCs to improve detection.
