Check Point Research Warns AI Antidetect Browsers Fuel Fraud and Influence Ops

Check Point Research published a report detailing how AI-powered antidetect browsers are being abused to conduct large-scale financial fraud and influence operations. The analysis highlights that these tools allow a single operator or small team to manage thousands of isolated accounts across major social platforms while evading standard detection mechanisms designed to catch coordinated inauthentic behavior.

The research specifically names Kameleo, AdsPower, and MultiLogin as the three main antidetect browsers under scrutiny. According to Check Point, these tools were selected based on documented references in underground forums and criminal marketplaces, indicating active adoption beyond their stated commercial purposes in digital marketing and privacy protection.

The Mechanics of Identity Obfuscation

Antidetect browsers function by obscuring the digital identity of the user, enabling them to run below the surface where social platforms primarily detect coordinated activity. By presenting each account as a distinct, legitimate user, these tools prevent detection systems from linking multiple profiles to a single operator. This capability allows threat actors to operate at machine speed using built-in automation templates and dedicated MCP servers that pipe LLM-generated content directly into pre-warmed account profiles.

The integration of artificial intelligence means that running a large-scale social media operation now requires only a credit card rather than a technical team. These platforms enable users to simulate thousands of isolated environments, each with unique digital fingerprints, effectively defeating platform detection methods at every layer of the identity stack.

Fraud and Influence Operations

Threat actors are using these compromised accounts for various malicious purposes, including financial fraud, phishing, and malware distribution. According to the report, confirmed use cases include account takeover operations where session cookies harvested by infostealer malware are injected into clean browser profiles to assume control of banking accounts and cryptocurrency wallets without triggering authentication alerts.

Other documented abuses include carding operations, where stolen payment credentials are tested across e-commerce platforms under the guise of distinct legitimate users, and fraudulent loan applications submitted under fabricated identities. Anthropic’s September 2026 Threat Intelligence Report also documented attackers using antidetect browsers in a fraud campaign targeting cryptocurrency exchanges and financial marketplaces, combining these profiles with residential proxies and CAPTCHA-solving tools to bypass onboarding security checks.

The risk is heightened because these accounts often pass KYC verification and build legitimate activity histories, appearing benign during transactions. Consequently, fraud detection systems relying on user behavior or device identity frequently fail to identify these accounts as suspicious until after fraudulent activity has already occurred.

Who Is Affected

The infrastructure enabling this financial fraud is equally applicable to Coordinated Inauthentic Behavior (CIB), which involves organized manipulation campaigns using false identities to evade detection. Meta’s most recent transparency reporting explicitly flagged this as a growing concern, identifying Russia, Iran, and China as the three leading sources of such activity globally. This suggests that the same tools used for economic crime are being leveraged to influence public discourse and potentially disrupt elections.

What should you do?

Security professionals should monitor for unusual account creation patterns and investigate anomalies in device fingerprinting data. Organizations should review their detection strategies to ensure they are not solely reliant on behavioral analysis, which antidetect browsers are designed to bypass.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: Check Point Research

• Review account creation logs for spikes in new profiles originating from similar IP ranges or using residential proxies.
• Implement stricter device attestation processes that go beyond standard browser fingerprinting to verify hardware authenticity.
• Monitor for automated content generation patterns that may indicate the use of LLM-integrated antidetect tools.
• Ensure that fraud detection systems incorporate cross-platform correlation to identify coordinated activity across multiple social networks.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which antidetect browsers are identified in the Check Point Research report?

The report highlights Kameleo, AdsPower, and MultiLogin as the three main tools being abused by threat actors.

How do these browsers help attackers evade detection?

They obscure digital identities and allow operators to manage thousands of isolated accounts that appear as distinct, legitimate users to platform detection systems.

What types of fraud are enabled by these tools?

Documented abuses include account takeovers, carding operations, fraudulent loan applications, and coordinated inauthentic behavior campaigns.