Check Point: AI-integrated antidetect browsers (Kameleo, AdsPower, MultiLogin) fuel account takeover, fraud and influence operations
Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage proxies and automate activity, letting one operator run thousands of isolated accounts that evade platform detection. AI integration, including a dedicated Model Context Protocol (MCP) server in AdsPower and automation templates, now allows LLM-generated content to be pushed into pre-warmed profiles at machine speed. The report cites Anthropic's September 2026 Threat Intelligence Report, which documented a fraud campaign against cryptocurrency exchanges that combined antidetect profiles, residential proxies, CAPTCHA solving and identity-verification bypass. Check Point also flags the election-related risk, citing Meta's reporting that Russia, Iran and China are the leading sources of CIB. The vendors are legally registered and have legitimate marketing and privacy use cases.
Technical Details
- Fingerprint spoofing covers canvas, WebGL, fonts, screen resolution, time zone, user agent and hardware identifiers. WebRTC leak suppression and per-profile residential proxies keep each synthetic identity consistent.
- Kameleo modifies browser engines at the source level and offers a cookie injection API that accepts session IDs, refresh tokens and authentication flags. Pre-authenticated sessions are loaded without a login event that could trigger anomaly detection.
- A Russian-language forum post presents Kameleo as a component of Browser-in-the-Middle phishing kits targeting Google, Microsoft, Facebook and financial platforms. The phishing server creates a profile per victim with a local residential proxy and passes credentials to the real login page in real time.
- An AiTM engine sold as a service exports harvested session credentials directly into antidetect browsers. A recruitment post advertises an infostealer with RAT capabilities compatible with 21 browsers, including Kameleo, AdsPower and MultiLogin, that harvests cookies, tokens, wallets, API keys and 2FA data.
- AdsPower supports 20+ fingerprint parameters, claims a 99.2% ban avoidance rate and offers tiers of 5,000+ profiles. It also provides an RPA Marketplace (liking, commenting, DMs, follower scraping), a multi-window synchronizer, account warming, a Cookie Robot for TikTok/X and an MCP server for LLM workflows.
- MultiLogin provides cloud Android phone farming, virtual phone numbers for SMS verification, Selenium/Playwright/Puppeteer automation and AI Quick Actions. It accepts cryptocurrency, SberPay and YooMoney (both Sberbank-linked, OFAC-sanctioned) and is tested daily against 50+ platforms.
- Underground forums also sell an Android antidetect tool (geolocation spoofing, device ID replacement, Play Integrity bypass) at 100 USD per month, plus farmed accounts such as Google Ads accounts, sold with instructions to access them via antidetect browsers.
- Influence-operation workflow: warmed fake accounts join closed groups, scrape member data (interests, religion, location, engagement) and use it to target calibrated narratives.
Remediation
- Do not rely solely on device fingerprint or session continuity for fraud decisions, since these signals can be fabricated.
- Monitor for pre-authenticated session anomalies, cookie injection patterns, large-scale residential proxy use and WebRTC suppression.
- Correlate behavior across accounts and infrastructure rather than assessing profiles in isolation.
- Strengthen KYC and onboarding checks against farmed accounts that build benign histories before fraud.
Linha do tempo
-
Check Point: AI-integrated antidetect browsers (Kameleo, AdsPower, MultiLogin) fuel account takeover, fraud and influence operations
Compared with the existing case, this article adds the Anthropic September 2026 report on antidetect-assisted fraud against crypto exchanges, Kameleo's role in Browser-in-the-Middle phishing kits and its cookie injection API, MultiLogin's cloud phone farming and acceptance of OFAC-sanctioned SberPay and YooMoney, AdsPower's Cookie Robot, an Android antidetect tool sold at 100 USD per month, underground sales of farmed accounts, and Meta's identification of Russia, Iran and China as leading CIB sources.
ler a análise desta fonte ocultar
Compared with the existing case, this article adds the Anthropic September 2026 report on antidetect-assisted fraud against crypto exchanges, Kameleo's role in Browser-in-the-Middle phishing kits and its cookie injection API, MultiLogin's cloud phone farming and acceptance of OFAC-sanctioned SberPay and YooMoney, AdsPower's Cookie Robot, an Android antidetect tool sold at 100 USD per month, underground sales of farmed accounts, and Meta's identification of Russia, Iran and China as leading CIB sources.
Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage proxies and automate activity, letting one operator run thousands of isolated accounts that evade platform detection. AI integration, including a dedicated Model Context Protocol (MCP) server in AdsPower and automation templates, now allows LLM-generated content to be pushed into pre-warmed profiles at machine speed. The report cites Anthropic's September 2026 Threat Intelligence Report, which documented a fraud campaign against cryptocurrency exchanges that combined antidetect profiles, residential proxies, CAPTCHA solving and identity-verification bypass. Check Point also flags the election-related risk, citing Meta's reporting that Russia, Iran and China are the leading sources of CIB. The vendors are legally registered and have legitimate marketing and privacy use cases.
Technical Details
- Fingerprint spoofing covers canvas, WebGL, fonts, screen resolution, time zone, user agent and hardware identifiers. WebRTC leak suppression and per-profile residential proxies keep each synthetic identity consistent.
- Kameleo modifies browser engines at the source level and offers a cookie injection API that accepts session IDs, refresh tokens and authentication flags. Pre-authenticated sessions are loaded without a login event that could trigger anomaly detection.
- A Russian-language forum post presents Kameleo as a component of Browser-in-the-Middle phishing kits targeting Google, Microsoft, Facebook and financial platforms. The phishing server creates a profile per victim with a local residential proxy and passes credentials to the real login page in real time.
- An AiTM engine sold as a service exports harvested session credentials directly into antidetect browsers. A recruitment post advertises an infostealer with RAT capabilities compatible with 21 browsers, including Kameleo, AdsPower and MultiLogin, that harvests cookies, tokens, wallets, API keys and 2FA data.
- AdsPower supports 20+ fingerprint parameters, claims a 99.2% ban avoidance rate and offers tiers of 5,000+ profiles. It also provides an RPA Marketplace (liking, commenting, DMs, follower scraping), a multi-window synchronizer, account warming, a Cookie Robot for TikTok/X and an MCP server for LLM workflows.
- MultiLogin provides cloud Android phone farming, virtual phone numbers for SMS verification, Selenium/Playwright/Puppeteer automation and AI Quick Actions. It accepts cryptocurrency, SberPay and YooMoney (both Sberbank-linked, OFAC-sanctioned) and is tested daily against 50+ platforms.
- Underground forums also sell an Android antidetect tool (geolocation spoofing, device ID replacement, Play Integrity bypass) at 100 USD per month, plus farmed accounts such as Google Ads accounts, sold with instructions to access them via antidetect browsers.
- Influence-operation workflow: warmed fake accounts join closed groups, scrape member data (interests, religion, location, engagement) and use it to target calibrated narratives.
Remediation
- Do not rely solely on device fingerprint or session continuity for fraud decisions, since these signals can be fabricated.
- Monitor for pre-authenticated session anomalies, cookie injection patterns, large-scale residential proxy use and WebRTC suppression.
- Correlate behavior across accounts and infrastructure rather than assessing profiles in isolation.
- Strengthen KYC and onboarding checks against farmed accounts that build benign histories before fraud.
-
Check Point Research: AI-enabled antidetect browsers scale account takeover, payment fraud and influence operations
ler a análise desta fonte ocultar
Check Point Research reports that antidetect browsers such as AdsPower, MultiLogin and Kameleo are used in criminal ecosystems for account takeover, payment card fraud, fraudulent loan applications and bulk creation of artificial accounts. These tools combine browser fingerprint manipulation with proxy integration, automation and multi-account management, so one operator can run many profiles that look like independent users. AI integrations and automation further scale this, and the same accounts can support influence operations, a concern ahead of elections. The tools also have legitimate uses.
Technical Details
- Antidetect browsers manipulate fingerprint signals (screen resolution, time zone, fonts, WebGL, hardware characteristics, WebRTC, language) across five layers: device, network, session, behavior and content.
- Underground forums advertised an adversary-in-the-middle engine that exports harvested session credentials directly into antidetect browsers. Another recruitment post advertised infostealer malware compatible with multiple antidetect platforms to harvest session cookies and authentication tokens.
- Account takeover workflows load stolen session cookies into browser profiles, combined with residential proxies and manipulated device identities.
- AdsPower offers pricing tiers supporting thousands of profiles, RPA automation templates (liking, commenting, direct messaging, follower scraping), tools to build account activity history, and a dedicated Model Context Protocol server for LLM workflow integration.
- The tools are discussed and advertised on Russian-language underground forums.
Remediation
- Monitor infrastructure signals: antidetect browser indicators in web traffic, large-scale residential proxy use and WebRTC suppression patterns.
- Strengthen session monitoring for pre-authenticated session anomalies and unusual cookie injection sequences.
- Review fraud controls that depend heavily on device consistency or session continuity, as these signals can be manipulated.
- Correlate suspicious behavior across accounts rather than assessing individual profiles in isolation.