A category of commercially available software built to manage multiple browser profiles is getting a new look from researchers, who say criminal groups are using it — alongside AI automation — to run large fleets of fake accounts that each appear to belong to a different, legitimate person.

What “antidetect” browsers actually do

Check Point Research, in an October 20 report, examined three widely used platforms — Kameleo, AdsPower, and MultiLogin — and found they share a common design: each lets an operator spin up isolated browser profiles, where every profile keeps its own cookies, local storage, and session data separate from the others, while also letting the operator control or randomize the technical fingerprint each profile presents to a website.

That fingerprint — built from details like screen resolution, time zone, installed fonts, language settings, and graphics hardware signatures — is one of the main ways platforms try to spot when supposedly unrelated accounts are actually being run by the same person or script. Antidetect browsers are explicitly designed to make that comparison difficult, by assigning each profile a distinct, believable-looking fingerprint rather than reusing the same one across hundreds of accounts.

Check Point is careful to note these tools are not malware in the traditional sense and have legitimate uses, such as agencies managing multiple client social media accounts or QA teams testing how sites behave across device configurations. The concern is that the same profile-isolation features are turned to criminal use on underground forums and marketplaces, often bundled with proxy services as part of a ready-made “operational stack” for fraud.

Where AI changes the equation

What’s pushing this into current headlines is the addition of AI and automation features that reduce the manual effort of running thousands of accounts at once. AdsPower, for instance, advertises support for the Model Context Protocol, a standard that lets large language model tools connect directly to browser automation workflows. Check Point’s researchers describe a plausible pipeline where AI-generated text, images, or responses are paired with automated profile creation and activity, letting a small team or even a single operator run an operation that would previously have required a much larger workforce.

Some platforms go further, offering templated “warming” routines that build up a believable activity history for a brand-new profile over time — browsing patterns, gradual engagement, realistic timing — specifically so the account doesn’t look freshly created when it starts being used for fraud. That warming process can help an account pass identity checks or risk scoring that would otherwise flag it, delaying detection until after fraudulent activity is already underway.

From fake accounts to account takeover

The report flags a more acute risk alongside the account-farming use case: stolen session cookies. A session cookie is what keeps a legitimate user logged in after they’ve already authenticated, and if an attacker steals that cookie — through malware, phishing, or a data breach — they can potentially load it into an antidetect browser profile and resume an already-authenticated session without ever triggering a new login or multi-factor authentication challenge.

That combination — a convincing fingerprint plus a valid stolen session — is particularly dangerous because it bypasses the controls most organizations rely on most heavily: password strength and MFA at the point of login. If the session itself is hijacked downstream of that login, those controls never get a chance to fire.

Researchers listed a range of potential criminal uses tied to this toolset, including:

• Account takeover of social media, email, and financial accounts
• Payment fraud and fraudulent loan applications
• Advertising fraud and inflated engagement metrics
• Phishing and malware distribution campaigns run from “clean”-looking accounts
• Coordinated manipulation of online discussion and reviews

How defenders should respond

Because antidetect tools are purpose-built to make individual accounts look unrelated, Check Point argues that defenders need to stop relying on single-account signals and instead correlate activity across infrastructure: large-scale residential proxy usage, clusters of unusual fingerprint changes, and session access patterns that don’t match a user’s normal device or location.

For organizations specifically, the practical advice is to extend session monitoring beyond the login event itself — watching for an authenticated session suddenly appearing on an unfamiliar device or network, even when no new password or MFA prompt was triggered — and to be prepared to invalidate active sessions quickly once an account is confirmed compromised, rather than treating a password reset alone as sufficient remediation.