Check Point: Antidetect Browsers and AI Help Scale Online Fraud
Check Point Research says antidetect browsers are being used in criminal ecosystems for account takeover and payment fraud, and that AI and automation can further increase the scale of such operations. The tools let one operator run many browser profiles that look like separate users, devices and locations.
- Check Point Research found documented use of antidetect browsers in criminal ecosystems for account takeover and payment fraud.
- Tools such as AdsPower, MultiLogin and Kameleo combine fingerprint manipulation, proxy integration, automation and multi-account management.
- AdsPower advertises a Model Context Protocol server for large language model workflows, which Check Point says can scale operations.
- Check Point recommends monitoring infrastructure, network and session signals rather than only individual account behavior.
How antidetect browsers hide the link between accounts
Every browser exposes details that websites can use to tell users apart, according to Check Point. These include screen resolution, time zone, browser type, fonts, WebGL information and hardware characteristics. Together they form a browser fingerprint.
Antidetect browsers manipulate these signals so each profile appears to be a different user or device. They are widely used to manage multiple accounts on platforms such as Facebook, Instagram, TikTok, YouTube and X, and also across e-commerce, financial services and professional networks. Check Point notes that the tools have legitimate uses.
The result is a visibility problem for platforms: one operator can control many profiles, each with its own device characteristics and network identity. Check Point Research identified five layers through which these browsers can obscure the connection: device, network, session, behavior and content.
Use in cybercrime and a commercial ecosystem
Researchers found references on underground forums and criminal marketplaces to antidetect browsers being built into wider attack workflows. These include account takeover in which stolen session cookies are loaded into browser profiles, payment card fraud, fraudulent loan applications and bulk creation of artificial accounts.
One forum advertisement offered an adversary-in-the-middle engine that could export harvested session credentials directly into antidetect browsers. Another recruitment post advertised infostealer malware compatible with multiple antidetect platforms, used to harvest data such as session cookies and authentication tokens.
Check Point describes a commercial ecosystem. AdsPower publishes pricing tiers supporting thousands of profiles and offers automation templates for liking, commenting, direct messaging and follower scraping. Its interface lets operators set fingerprint parameters such as WebRTC, time zone, location and language per profile. MultiLogin provides isolated profiles, automation support and mobile infrastructure, while Kameleo offers fingerprint manipulation and automation. The research also found these tools discussed and advertised on Russian-language underground forums, with subscriptions, documentation, customer support and integrations.
Where AI raises the scale
Maintaining many identities used to require substantial manual work, as profiles had to be created and operated and content written and distributed. According to Check Point, parts of that workflow can increasingly be automated.
The company points out that AdsPower advertises a dedicated Model Context Protocol server for integration with large language model workflows, alongside automation templates and tools for building activity histories for accounts before operational use. This creates the potential for a workflow in which AI generates content and automation distributes it across multiple isolated identities.
Check Point also warns about coordinated inauthentic activity. These accounts can be used for influence operations, which it says becomes a greater concern ahead of elections.
What organizations should do
Check Point argues that detecting an individual account may no longer be enough, because antidetect browsers manipulate many of the signals used to judge whether a session, device or user is legitimate. It recommends that organizations:
- Monitor infrastructure signals: look for antidetect browser indicators, large-scale residential proxy use and WebRTC suppression patterns.
- Strengthen session monitoring: identify pre-authenticated session anomalies and unusual cookie injection sequences.
- Review fraud controls: assess controls that rely heavily on device consistency or session continuity, since these signals can be manipulated.
- Look for connected activity: evaluate suspicious behavior across accounts, not only within one profile.
For security and fraud teams, the message is to shift attention from single accounts to the infrastructure linking them. In Check Point's words, the key question is increasingly whether thousands of seemingly independent accounts are actually independent at all.
Check Point: Antidetect Browsers: How AI Is Scaling Online Fraud and Account Takeovers
