Check Point Research Details How AI-Enabled Antidetect Browsers Support Fraud and Influence Operations
Summary
Check Point Research examines how Kameleo, AdsPower, and MultiLogin use fingerprint spoofing, proxies, and AI automation to support fraud, account takeovers, phishing, and influence operations, and recommends detection measures.
Key points
- The report examines Kameleo, AdsPower, and MultiLogin, describing browser fingerprint spoofing, isolated profiles, and proxy features used to conceal account operators.
- Underground-forum evidence and documented workflows link antidetect browsers to session-cookie injection, infostealer activity, and Browser-in-the-Middle phishing.
- The report describes AdsPower automation features that can combine warmed account profiles, AI-generated content, and bulk activity across platforms.
- Reported criminal use cases include account takeover, payment-card testing, fraudulent loan applications, and artificial advertising activity.
- The research outlines how farmed accounts and scraped data could support targeted, coordinated influence campaigns.
- Recommendations include monitoring proxy infrastructure, WebRTC suppression, anomalous cookie injection, and device-fingerprint consistency over time.
Article Details
- Attack Vectors
- Antidetect browsers spoof browser fingerprints and assign distinct profiles to evade platform account and device detection.
- The article describes account-takeover workflows that inject infostealer-harvested session cookies or tokens into clean browser profiles.
- Browser-in-the-Middle phishing kits use antidetect profiles and residential proxies to relay victims' credentials to target services.
- Residential proxies, CAPTCHA solving, and identity-verification bypass tools are described as supporting mass creation of verified accounts for fraud.
- Automated profile warming, scraping, and AI-generated content distribution can support coordinated inauthentic activity and influence operations.
- Defensive Notes
- Prioritize network and infrastructure-layer detection, including residential proxy use at scale, WebRTC suppression, anomalous cookie injection, and known antidetect browser user-agent strings.
- Correlate device-fingerprint consistency over time to investigate account-warming patterns that may otherwise resemble organic activity.
- Review session monitoring for pre-authenticated session anomalies and incorporate antidetect-specific scenarios into red-team exercises and threat models.
- Review fraud detection systems for resilience to fingerprint spoofing, session injection, and replicated victim device or geolocation signals.
- Platforms should consider acquiring and reverse engineering antidetect tools to identify proxy patterns, fingerprint rotation, and detection-bypass mechanisms.
MITRE ATT&CK
T1056.003 · Web Portal CaptureIn the described Browser-in-the-Middle workflow, victims enter credentials on a phishing page that relays them in real time to the target service's login page.T1090.002 · External ProxyThe reported fraud workflow combines antidetect profiles with residential proxies to make account activity appear to originate from distinct locations.T1119 · Automated CollectionThe article describes automated scraping of social-platform member data, including profile details and engagement patterns, for campaign targeting.T1539 · Steal Web Session CookieThe article reports infostealer malware harvesting session cookies for use in account-takeover operations.T1550.004 · Web Session CookieAntidetect browser profiles can receive harvested session cookies to access accounts as pre-authenticated users without a login event.T1566 · PhishingThe article describes Browser-in-the-Middle phishing kits using antidetect browsers to target credentials for Google, Microsoft, Facebook, and financial platforms.T1585.001 · Social Media AccountsThe article describes bulk creation and warming of artificial social-media accounts for fraud and coordinated influence activity.T1589 · Gather Victim Identity InformationThe described scraping workflow gathers information about members of closed social groups, including names, interests, and geographic markers, for targeting.
Vendors
AdsPowerThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.KameleoThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.MultiLoginThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.
Products
AdsPowerThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.KameleoThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.MultiLoginThe three main antidetect browsers we discuss in this report are Kameleo, AdsPower, and MultiLogin.
Tools
PlaywrightThe platform supports automation through Selenium, Playwright, and Puppeteer, enabling fully scripted, headless operation of multiple profiles simultaneously.PuppeteerThe platform supports automation through Selenium, Playwright, and Puppeteer, enabling fully scripted, headless operation of multiple profiles simultaneously.SeleniumThe platform supports automation through Selenium, Playwright, and Puppeteer, enabling fully scripted, headless operation of multiple profiles simultaneously.
Countries
ChinaMeta’s most recent transparency reporting explicitly flagged this as a growing concern, with Russia, Iran, and China identified as the three leading sources of such activity globally.IranMeta’s most recent transparency reporting explicitly flagged this as a growing concern, with Russia, Iran, and China identified as the three leading sources of such activity globally.RussiaMeta’s most recent transparency reporting explicitly flagged this as a growing concern, with Russia, Iran, and China identified as the three leading sources of such activity globally.
Industries
E-commerceCarding operations in which stolen payment credentials are tested across e-commerce platforms under the guise of distinct legitimate users.Financial ServicesAs seen in Figure 11, its account editor supports platforms spanning social media, e-commerce, financial services, and professional networks including Facebook, Amazon, LinkedIn, X, PayPal, and Google.Social mediaRunning a large-scale social media operation now requires only a credit card instead of a technical team.