AI Browsers Let Attackers Create Thousands of Undetected Fake Accounts

Key Takeaways

• Cybercriminals are leveraging AI-powered “antidetect” browsers to create and manage thousands of fake online accounts.
• These specialized browsers mask digital fingerprints, making each fraudulent account appear unique in terms of user, device, and location.
• The tools facilitate large-scale fraud, account takeovers, and influence operations by bypassing traditional security detections.
• While the browsers themselves are legitimate software, their misuse by malicious actors poses a significant threat to online platforms and users.
• Defenders must shift from isolated account monitoring to comprehensive analysis of network, infrastructure, and session-level anomalies.

Cybercriminals are increasingly employing sophisticated AI-enabled “antidetect” browsers to orchestrate vast networks of fraudulent online accounts, successfully evading detection by presenting each profile as distinct in terms of user identity, device characteristics, and geographic location. This alarming trend allows individual operators or small groups to manage thousands of accounts across various social media and other digital platforms, significantly complicating efforts by service providers to identify and neutralize coordinated malicious activity.

While these browsers possess legitimate applications, their presence and active discussion within criminal forums and underground marketplaces have been extensively documented by analysts at Check Point Research. The researchers have detailed their pervasive use in schemes involving fraud and account takeover operations, highlighting a critical emerging threat landscape.

In a report published on October 20, 2026, Check Point Research specifically named Kameleo, AdsPower, and MultiLogin as prominent tools equipped with features that enable such illicit activities. These platforms combine advanced profile isolation and identity masking capabilities with automation, and in certain instances, integrate artificial intelligence to enhance their deceptive power.

It is crucial to note that Check Point’s report does not classify these browsers as inherently malicious software. Instead, it serves as a stark warning about the potential for commercially available software to be weaponized by criminals to conceal and scale coordinated online operations.

Hackers Exploit AI-Powered Browsers

Websites typically gather a range of data points from a user’s browser and device, including screen dimensions, time zone, language preferences, user agent strings, and graphics settings. Collectively, these data points form a unique “browser fingerprint.” Online platforms often leverage these fingerprints, alongside behavioral patterns, to identify accounts that might originate from the same device or be controlled by a single operator. Antidetect browsers, as highlighted by Check Point, are designed to manipulate or assign disparate values to these profile attributes, thereby thwarting such comparative analysis and making detection considerably more challenging.

These tools also meticulously isolate each profile’s cookies, local storage, and session information, preventing cross-contamination that could expose linked accounts. Furthermore, many antidetect browsers seamlessly integrate with proxy services, enabling profiles to appear as if they are connecting from diverse network locations and IP addresses. This capability significantly undermines security measures that rely solely on an account’s IP address or geographic origin for fraud detection. The use of residential proxies, for instance, can effectively camouflage malicious traffic, although proxy usage in itself does not definitively indicate criminal intent.

A particularly grave risk emerges when threat actors employ stolen session cookies. A valid session cookie allows a user to remain authenticated on a service without needing to re-enter credentials. If such a cookie is compromised and subsequently reused, an attacker can gain unauthorized access to an active account, completely bypassing standard login procedures. Check Point’s research indicates that criminals can inject stolen session data directly into an antidetect browser profile, making the illicit session appear legitimate and familiar to the targeted service. This tactic underscores the broader implications of session-cookie theft and account takeover, where access to an already authenticated session can render initial login-based security protections ineffective.

AI and Automation Drive Scale of Malicious Operations

The integration of AI features and automation within these antidetect browsers dramatically reduces the manual effort required to manage a multitude of fake accounts, thereby enabling operations at an unprecedented scale. For example, AdsPower promotes a “Model Context Protocol (MCP) server” specifically designed to link large language model workflows with browser profiles. This functionality could facilitate a pipeline where AI-generated text is coupled with automated account activity and distributed across a vast network of deceptive profiles. While this does not imply that every user of these products is engaged in illicit campaigns, it undeniably lowers the barrier to entry and simplifies the scaling of coordinated misuse.

Beyond AI integration, some platforms also offer templates for automating repetitive actions and tools for progressively building credible activity histories for new accounts over time. This “warming” process is designed to make freshly created profiles appear more established and less suspicious, delaying detection until fraudulent activities commence. Check Point cautions that these accounts can accumulate convincing digital histories and even pass certain identity verification checks, allowing them to operate undetected until they initiate fraudulent transactions or influence operations.

The potential for misuse spans a wide array of illicit activities, including but not limited to account takeover, payment fraud, submission of fake loan applications, advertising fraud, phishing campaigns, malware distribution, and coordinated efforts to manipulate online discussions and public opinion.

The implications extend to organizations whose employee or customer accounts become targets. A hijacked session could grant an attacker access to sensitive email, financial services, or other interconnected systems. As highlighted in a Cybersecurity News report concerning Microsoft 365 session theft post-MFA, security teams must prioritize continuous monitoring of active sessions, rather than solely focusing on initial login credentials or multi-factor authentication challenges.

Check Point advises security professionals to broaden their detection strategies beyond individual account behavior, given that antidetect tools are specifically engineered to make each profile appear disconnected. Instead, security teams should meticulously examine network and infrastructure-level signals, such as large-scale residential proxy activity, anomalous browser fingerprint changes, and suspicious patterns related to session-cookie injection or pre-authenticated sessions. Organizations should also verify that their session monitoring capabilities are robust enough to identify unusual access patterns to already authenticated accounts.

For online platforms, while account-level signals remain relevant, they must be augmented with comprehensive infrastructure analysis and the investigation of suspicious patterns observed across multiple profiles. Corporate security reviews should encompass scenarios where a valid session is exploited from an unexpected device or network, even in the absence of a new password prompt. In cases where an account is confirmed compromised, invalidating active sessions, similar to other session-hijacking countermeasures, may be a necessary step. The fundamental takeaway is that antidetect browsers are not a singular malware family with a fixed signature; rather, they are versatile tools that mask identity signals, with automation and AI enabling criminals to operate at an unprecedented scale. Consequently, defenders must correlate signals across accounts, devices, networks, and sessions, moving beyond reliance on any single indicator.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement Advanced Behavioral Analytics: Move beyond simple IP or device fingerprinting. Employ AI-driven behavioral analytics that can detect subtle anomalies across user sessions, even when individual profiles appear legitimate.
• Enhance Session Monitoring: Continuously monitor active user sessions for unusual patterns, such as sudden changes in geographic location, device characteristics mid-session, or unexpected access to sensitive resources, even without a new login event.
• Strengthen Authentication and Session Management: Regularly review and update session management policies. Consider implementing stricter session timeouts for high-risk accounts or actions.
• Integrate Threat Intelligence: Subscribe to and integrate threat intelligence feeds that track the use of antidetect browsers and other fraud tools.
• Educate Users: Train employees and users about the risks of session hijacking and credential theft, and encourage strong password hygiene and vigilance against phishing attempts.
• Review Infrastructure Logs: Scrutinize network and infrastructure logs for signs of large-scale residential proxy usage or other suspicious network activity that could indicate coordinated fraudulent operations.
• Develop Incident Response Plans: Ensure your incident response plan includes procedures for addressing sophisticated account takeover attempts facilitated by antidetect browsers, including steps for immediate session invalidation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.