Check Point: AI-integrated antidetect browsers Kameleo, AdsPower and MultiLogin scale account takeover, fraud and influence operations

Linha do tempo

1. gbhackers.com ↗ · pub. 21/10/2026 10:03 · coletado 21/10 12:00

   Check Point: Antidetect Browsers Kameleo, AdsPower and MultiLogin Combine with AI Automation to Scale Fraud and Fake Accounts

   ler a análise desta fonte ocultar

   Check Point Research warns that commercial antidetect browsers, notably Kameleo, AdsPower and MultiLogin, are referenced in criminal forums and marketplaces for account takeover, payment fraud, fake loan applications and bulk account creation for advertising fraud. The tools create separate browser profiles with altered fingerprints and, paired with proxies, let operators run thousands of apparently unrelated accounts. Researchers say integration with AI and automation, such as the AdsPower MCP server connected to its Local API, lowers the effort needed to scale fraud and coordinated influence campaigns. The headline's reference to "Gemini-compatible" browsers is a compatibility concern only. The article states that AdsPower documentation names Claude Desktop and Cursor, not Gemini, and that no Gemini-driven campaign was demonstrated. The tools have legitimate uses, and the risk comes from criminals combining them with stolen credentials, proxies and automation.

   Technical Details

   • Antidetect browsers spoof fingerprint signals (screen resolution, time zone, fonts, user-agent, Canvas/WebGL) and, with residential proxies, appear to connect from different network locations. This weakens platforms' correlation of account, device and behavior signals.
   • Stolen session cookies can be loaded into profiles, giving pre-authenticated access without a conventional login event.
   • In a Browser-in-the-Middle attack, the phishing server instructs the antidetect browser to create a profile for the victim, with a residential proxy in the victim's country and a clean fingerprint.
   • The report cites underground ads for credential-harvesting services that export stolen session data to antidetect browsers, and for malware advertised as compatible with multiple browser platforms.
   • Targeted platforms include Facebook, Amazon, LinkedIn, X, PayPal and Google.
   • Check Point cites Anthropic's September 2026 threat-intelligence report on a campaign against cryptocurrency exchanges and financial marketplaces that used antidetect profiles, residential proxies, CAPTCHA-solving and identity-verification bypass tools.

   Remediation

   • Look beyond single-account activity and review infrastructure and session signals: large-scale proxy use, unusual session-cookie activity and signs of pre-authenticated access.
   • Reassess fraud controls that depend heavily on device consistency.
2. research.checkpoint.com ↗ · pub. 20/10/2026 11:17 · coletado 20/10 16:30

   Check Point: AI-integrated antidetect browsers (Kameleo, AdsPower, MultiLogin) fuel account takeover, fraud and influence operations

   Compared with the existing case, this article adds the Anthropic September 2026 report on antidetect-assisted fraud against crypto exchanges, Kameleo's role in Browser-in-the-Middle phishing kits and its cookie injection API, MultiLogin's cloud phone farming and acceptance of OFAC-sanctioned SberPay and YooMoney, AdsPower's Cookie Robot, an Android antidetect tool sold at 100 USD per month, underground sales of farmed accounts, and Meta's identification of Russia, Iran and China as leading CIB sources.

   ler a análise desta fonte ocultar

   Compared with the existing case, this article adds the Anthropic September 2026 report on antidetect-assisted fraud against crypto exchanges, Kameleo's role in Browser-in-the-Middle phishing kits and its cookie injection API, MultiLogin's cloud phone farming and acceptance of OFAC-sanctioned SberPay and YooMoney, AdsPower's Cookie Robot, an Android antidetect tool sold at 100 USD per month, underground sales of farmed accounts, and Meta's identification of Russia, Iran and China as leading CIB sources.

   Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage proxies and automate activity, letting one operator run thousands of isolated accounts that evade platform detection. AI integration, including a dedicated Model Context Protocol (MCP) server in AdsPower and automation templates, now allows LLM-generated content to be pushed into pre-warmed profiles at machine speed. The report cites Anthropic's September 2026 Threat Intelligence Report, which documented a fraud campaign against cryptocurrency exchanges that combined antidetect profiles, residential proxies, CAPTCHA solving and identity-verification bypass. Check Point also flags the election-related risk, citing Meta's reporting that Russia, Iran and China are the leading sources of CIB. The vendors are legally registered and have legitimate marketing and privacy use cases.

   Technical Details

   • Fingerprint spoofing covers canvas, WebGL, fonts, screen resolution, time zone, user agent and hardware identifiers. WebRTC leak suppression and per-profile residential proxies keep each synthetic identity consistent.
   • Kameleo modifies browser engines at the source level and offers a cookie injection API that accepts session IDs, refresh tokens and authentication flags. Pre-authenticated sessions are loaded without a login event that could trigger anomaly detection.
   • A Russian-language forum post presents Kameleo as a component of Browser-in-the-Middle phishing kits targeting Google, Microsoft, Facebook and financial platforms. The phishing server creates a profile per victim with a local residential proxy and passes credentials to the real login page in real time.
   • An AiTM engine sold as a service exports harvested session credentials directly into antidetect browsers. A recruitment post advertises an infostealer with RAT capabilities compatible with 21 browsers, including Kameleo, AdsPower and MultiLogin, that harvests cookies, tokens, wallets, API keys and 2FA data.
   • AdsPower supports 20+ fingerprint parameters, claims a 99.2% ban avoidance rate and offers tiers of 5,000+ profiles. It also provides an RPA Marketplace (liking, commenting, DMs, follower scraping), a multi-window synchronizer, account warming, a Cookie Robot for TikTok/X and an MCP server for LLM workflows.
   • MultiLogin provides cloud Android phone farming, virtual phone numbers for SMS verification, Selenium/Playwright/Puppeteer automation and AI Quick Actions. It accepts cryptocurrency, SberPay and YooMoney (both Sberbank-linked, OFAC-sanctioned) and is tested daily against 50+ platforms.
   • Underground forums also sell an Android antidetect tool (geolocation spoofing, device ID replacement, Play Integrity bypass) at 100 USD per month, plus farmed accounts such as Google Ads accounts, sold with instructions to access them via antidetect browsers.
   • Influence-operation workflow: warmed fake accounts join closed groups, scrape member data (interests, religion, location, engagement) and use it to target calibrated narratives.

   Remediation

   • Do not rely solely on device fingerprint or session continuity for fraud decisions, since these signals can be fabricated.
   • Monitor for pre-authenticated session anomalies, cookie injection patterns, large-scale residential proxy use and WebRTC suppression.
   • Correlate behavior across accounts and infrastructure rather than assessing profiles in isolation.
   • Strengthen KYC and onboarding checks against farmed accounts that build benign histories before fraud.
3. blog.checkpoint.com ↗ · pub. 20/10/2026 10:00 · coletado 20/10 13:00 primeiro registro

   Check Point Research: AI-enabled antidetect browsers scale account takeover, payment fraud and influence operations

   ler a análise desta fonte ocultar

   Check Point Research reports that antidetect browsers such as AdsPower, MultiLogin and Kameleo are used in criminal ecosystems for account takeover, payment card fraud, fraudulent loan applications and bulk creation of artificial accounts. These tools combine browser fingerprint manipulation with proxy integration, automation and multi-account management, so one operator can run many profiles that look like independent users. AI integrations and automation further scale this, and the same accounts can support influence operations, a concern ahead of elections. The tools also have legitimate uses.

   Technical Details

   • Antidetect browsers manipulate fingerprint signals (screen resolution, time zone, fonts, WebGL, hardware characteristics, WebRTC, language) across five layers: device, network, session, behavior and content.
   • Underground forums advertised an adversary-in-the-middle engine that exports harvested session credentials directly into antidetect browsers. Another recruitment post advertised infostealer malware compatible with multiple antidetect platforms to harvest session cookies and authentication tokens.
   • Account takeover workflows load stolen session cookies into browser profiles, combined with residential proxies and manipulated device identities.
   • AdsPower offers pricing tiers supporting thousands of profiles, RPA automation templates (liking, commenting, direct messaging, follower scraping), tools to build account activity history, and a dedicated Model Context Protocol server for LLM workflow integration.
   • The tools are discussed and advertised on Russian-language underground forums.

   Remediation

   • Monitor infrastructure signals: antidetect browser indicators in web traffic, large-scale residential proxy use and WebRTC suppression patterns.
   • Strengthen session monitoring for pre-authenticated session anomalies and unusual cookie injection sequences.
   • Review fraud controls that depend heavily on device consistency or session continuity, as these signals can be manipulated.
   • Correlate suspicious behavior across accounts rather than assessing individual profiles in isolation.