Antidetect browsers become fraud infrastructure, Check Point Research says

Antidetect browsers are not malicious by design. Regular browsers leave digital fingerprints such as screen resolution, operating system and fonts that can be used to identify a device across sessions. Antidetect software creates isolated profiles with different fingerprints, making multiple accounts appear to come from separate devices. The tools are mostly used by digital marketing agencies and affiliate marketers to manage social media, advertising and e-commerce accounts, run web scraping or test websites.

CPR said underground forums contain extensive discussion of using these browsers for fraud. It identified Kameleo, AdsPower, Multilogin, GoLogin and Dolphin Anty as prominent tools, and said the forums it analyzed focused mainly on Kameleo, AdsPower and Multilogin. CPR said it selected the three on the basis of documented references across underground forums and criminal marketplaces, indicating adoption beyond their stated commercial purposes. The discussions were generally linked to actors CPR described as Russian, Iranian and Chinese hackers.

The report says threat actors primarily use antidetect browsers to exploit stolen session cookies. By injecting a stolen cookie into a clean browser profile, an attacker can take control of an account and operate it without triggering alarms. Banking accounts and cryptocurrency wallets are the most popular targets, according to CPR. The researchers also said criminals use the browsers to test payment credentials across e-commerce platforms, apply for loans under fabricated identities and create fake accounts in bulk for advertising revenue at scale.

CPR said artificial intelligence is making these operations easier to scale. AdsPower, for example, offers integration with large language models through a Model Context Protocol server, allowing AI-powered workflows to connect with browser profiles. Through automation marketplaces, it also offers templates for commenting, liking or sending messages across multiple accounts. CPR said combining antidetect browsers, AI account management and AI-generated content lets threat actors run large coordinated campaigns with minimal human involvement and build and “warm up” fake accounts over time so they appear more credible.

CPR warned that the antidetect browser ecosystem is commercially mature and increasingly AI-driven. It said the tools are available in dozens of languages, backed by customer support teams, tested daily against major social media platforms and integrated with LLM pipelines that remove the human operator from the execution layer. The researchers advised security teams to look beyond account behavior and focus on infrastructure, including residential proxies, browser fingerprint inconsistencies and unusual session-cookie patterns. They also said social media platforms should analyze antidetect browsers to better understand how they bypass detection mechanisms, while companies should review whether their own controls account for the risk.

Editor's Summary

Check Point Research says antidetect browsers are being used with stolen session cookies and AI automation to hijack accounts, pass identity checks and run fraud at scale. The report describes a commercially maintained ecosystem that is increasingly integrated with LLM workflows and recommends infrastructure-focused detection and platform analysis of bypass techniques.