AI 'antidetect' browsers are making scams, fraud, and influence operations harder to spot

Cybercriminals use antidetect browsers to disguise devices, hijack accounts, and evade fraud detection systems Stolen session cookies, fake identities, and AI automation help scale scams and account abuse Researchers warn AI-integrated antidetect tools are lowering barriers for large-scale fraud operations Cybercriminals have started using antidetect browsers as part of their tech stack, helping them evade detection while deploying session cookies, creating thousands of fake accounts, and passing Know Your Customer (KYC) checks.

This is according to a new in-depth report published by security experts Check Point Research (CPR), in which it says that Russian, Iranian, and Chinese hackers are spearheading these activities.

What are antidetect browsers? When users log into services like Facebook or TikTok using regular browsers , they leave behind digital fingerprints - screen resolution, operating system, fonts.

This information can be used to identify and track a device across online sessions, and if a single entity (for example, a digital marketing agency) tries logging into multiple accounts from the same browser, it might trigger a security alert (or simply go against certain terms of service).

Hence the need for antidetect browsers - specialized software whose key feature is the ability to create isolated profiles with different digital fingerprints, making multiple accounts appear to originate from separate devices.

They are generally used to manage social media accounts, advertising, and e-commerce accounts, or to run web scraping operations or test websites across environments.

Antidetect browsers are not malicious by design, and are mostly used by digital marketing agencies and affiliate marketers.

However, just as many other good things, these browsers are actively used by cybercriminals to exploit the tech and run fraudulent accounts.

Many competing tools are available today, but a handful stand out - Kameleo, AdsPower, Multilogin, GoLogin, and Dolphin Anty.

According to CPR, underground forums are full of discussions on using antidetect browsers for different fraudulent activities.

These mostly originate from Chinese, Iranian, or Russian hackers, and generally revolve around Kameleo, AdsPower, and Multilogin.

“We selected these specifically on the basis of documented references across underground forums and criminal marketplaces, indicating active adoption beyond their stated commercial purposes,” CPR explained.

Analyzing these discussions, CPR discovered that the threat actors primarily use antidetect browsers to leverage stolen session cookies.

When they steal a cookie, they can inject it into a clean browser profile to assume control of the account and operate it unabated.