Anti-detect browsers: How AI is scaling online Fraud and Account takeovers

Key Findings Anti-detect browsers allow operators to manage large numbers of isolated browser profiles that appear to come from different users, devices and locations.

Check Point Research found documented use of anti-detect browsers in criminal ecosystems for account takeover, payment fraud and other malicious activity.

These accounts can also be used to coordinate influence operations, which becomes an even greater concern ahead of elections.

Anti-detect browsers such as AdsPower, MultiLogin and Kameleo combine browser fingerprint manipulation with proxy integration, automation and multi-account management.

AI integrations and automation can further scale these operations by supporting content generation and activity across multiple isolated identities.

Organisations should look beyond individual account behaviour and monitor infrastructure, network and session signals that may reveal coordinated activity.

What Are Anti-detect Browsers?

Every browser reveals information that websites can use to distinguish one user from another. This can include device screen resolution, time zone, browser type, fonts, WebGL information, hardware characteristics, and other parameters. Together, these signals can form a browser fingerprint.

Anti-detect browsers manipulate these signals, allowing each browser profile to appear as a different user or device. They are widely used for managing multiple online accounts, including across social media platforms such as Facebook, Instagram, TikTok, YouTube and X. The tools also support accounts across e-commerce, financial services and professional networks.

The result is a significant visibility challenge. One operator can control many profiles, while each can appear to a platform as an independent user with its own device characteristics and network identity.

Check Point Research identified five layers through which anti-detect browsers can obscure this connection, spanning device, network, session, behavior, and content.

How Anti-detect Browsers Are Used in Cybercrime

The significance of anti-detect technology goes beyond managing multiple social media profiles.

Check Point Research found documented references across underground forums and criminal marketplaces to anti-detect browsers being incorporated into broader attack workflows. These include account takeover operations in which stolen session cookies are loaded into browser profiles, payment card fraud, fraudulent loan applications, and the bulk creation of artificial accounts.

One underground forum advertisement identified by researchers offered an adversary-in-the-middle engine with functionality to export harvested session credentials directly into anti-detect browsers. Another recruitment post advertised infostealer malware compatible with multiple anti-detect platforms for harvesting data including session cookies and authentication tokens.

This combination matters because attackers are not relying on a single evasion technique. Anti-detect browsers can become one component of a larger infrastructure that combines stolen credentials, residential proxies, and manipulated device identities.

A Commercial Ecosystem Built for Scale

The tools analysed by Check Point Research illustrate how accessible these capabilities have become. AdsPower, for example, publishes pricing tiers supporting thousands of profiles and provides automation templates for activities including liking, commenting, direct messaging and follower scraping across multiple platforms. Its interface also allows operators to configure fingerprint parameters such as WebRTC, time zone, location and language for individual profiles.

Comparison of popular antidetect tools.

MultiLogin similarly provides isolated browser profiles, automation support and mobile infrastructure, while Kameleo provides browser fingerprint manipulation and automation capabilities. The research also identified discussions and advertisements for these tools on Russian-language underground forums.

The result is an ecosystem packaged much like conventional commercial software, with subscriptions, documentation, automation, customer support and integrations.

How AI Changes the Scale of Anti-detect Operations

AI adds another layer to this infrastructure. Previously, maintaining large numbers of identities required substantial manual work. Profiles had to be created, maintained and operated, while content had to be written and distributed.

The research shows how parts of that workflow can increasingly be automated. AdsPower advertises a dedicated Model Context Protocol server for integration with large language model workflows, alongside automation templates and tools for establishing activity histories for accounts before operational use.

This creates the potential for a connected workflow in which AI generates content while automation manages its distribution across multiple isolated identities. Instead of only making content creation faster, AI can therefore increase the operational scale of infrastructure designed to make many accounts appear independent.

Beyond financial fraud, these capabilities also have implications for coordinated inauthentic activity. Anti-detect browsers can make large numbers of accounts appear independent, while AI and automation can support content generation and distribution across those profiles. This combination creates a potential infrastructure for coordinated online activity at a scale that previously required significant effort.

image.png

Figure 3 - AdsPower's RPA Marketplace lists pre-built automation templates for bulk account activity across major platforms, including automated liking, commenting, direct messaging, follower scraping, and AI-assisted engagement.

Why Organisations Need to Look Beyond Account Behaviour

For security teams, the research highlights a broader challenge: detecting the account itself may not be enough.

Anti-detect browsers are designed to manipulate many of the signals organisations use to establish whether a session, device or user appears legitimate. Check Point Research recommends increasing attention to infrastructure-level indicators, including residential proxy infrastructure at scale, WebRTC suppression patterns, unusual cookie injection sequences and antidetect browser signals in web traffic.

Organisations should also review whether session-monitoring systems can identify pre-authenticated session anomalies and assess fraud controls that depend heavily on device consistency or session continuity.

How Organisations Can Respond to Anti-detect Browser Activity

As anti-detect browsers make individual accounts harder to assess in isolation, organisations should strengthen detection across the broader infrastructure and session level. Check Point Research recommends focusing on several areas:

Monitor infrastructure signals: Look for anti-detect browser indicators, large-scale use of residential proxies, and WebRTC suppression patterns.

Strengthen session monitoring: Identify anomalies involving pre-authenticated sessions and unusual cookie injection sequences.

Review fraud detection controls: Assess controls that rely heavily on device consistency or session continuity, as these signals can be manipulated.

Look for connected activity: Evaluate suspicious behaviour across accounts rather than relying only on the activity of an individual profile.

Anti-detect browsers have legitimate applications, but the same capabilities can also support malicious operations. The combination of identity spoofing, automation, proxy infrastructure and AI-assisted content generation can make it easier to operate large numbers of apparently independent online identities.

As these capabilities evolve, organisations will need to look beyond individual accounts and consider the infrastructure and signals connecting them. The key question is increasingly: are thousands of seemingly independent accounts actually independent at all? To read the full technical findings, access the Check Point Research publication here.