Researchers Warn Antidetect Browsers Enable Mass Fake Account Creation

Security researchers warn that antidetect browsers are enabling scammers to operate thousands of seemingly unrelated social media accounts by masking their digital identities. According to a report by GBHackers, tools such as Kameleo, AdsPower, and MultiLogin are being referenced in criminal forums for use in account takeovers, payment fraud, and advertising fraud. While these commercially available platforms have legitimate uses in marketing and e-commerce, their ability to alter browser fingerprints poses significant challenges for platforms attempting to detect coordinated abuse.

A browser fingerprint consists of technical signals like screen resolution, time zone, fonts, and Canvas output that websites use to distinguish one device from another. Antidetect browsers allow users to configure separate profiles so these signals appear different across multiple accounts. When combined with proxy services, these profiles can also appear to connect from different network locations. This combination makes commonly used identity signals less reliable, complicating efforts to correlate account, device, and behavior data for security purposes.

AI Integration Amplifies Risk

The risk associated with these tools is growing as they combine identity masking with automation and artificial intelligence integrations. Check Point Research notes that this convergence lowers the effort needed to scale account fraud and coordinated influence campaigns. AdsPower, for example, advertises an MCP server that connects AI systems to its Local API to support browser-automation tasks. The Model Context Protocol is a standard for connecting AI models to external tools, which Check Point warns could help operators distribute AI-generated content across multiple profiles with minimal manual work.

Check Point also highlights that stolen session cookies can be loaded into these browser profiles. This technique potentially allows criminals to access an already authenticated account without triggering a conventional login event. In a Browser-in-the-Middle attack scenario, a phishing server can instruct the antidetect browser to create a new profile for the victim. This profile is assigned a residential proxy in the victim's country and a clean device fingerprint, further obscuring the attacker's true identity and location from security monitoring systems.

Impact on Fraud Operations

The primary impact of these tools is the facilitation of bulk account creation for various fraudulent activities. Researchers found references to Kameleo, AdsPower, and MultiLogin in connection with fake loan applications and payment fraud. By making accounts appear less interconnected through varied digital fingerprints, these tools help operators evade detection mechanisms that rely on identifying patterns of coordinated behavior. Although the tools do not make accounts inherently invisible, they significantly degrade the reliability of identity signals that platforms use to flag suspicious activity.

What should you do?

Organizations should monitor for anomalies in login behavior and device fingerprints, particularly when accounts access services from unexpected geographic locations or with inconsistent technical signals. Security teams should review logs for signs of session cookie reuse or authentication events that bypass standard login procedures. Users should remain vigilant against phishing attempts that may lead to Browser-in-the-Middle attacks, where their browser configuration is manipulated to create fraudulent profiles. Once vendors provide updates or mitigations for these specific attack vectors, implementing them promptly will help reduce exposure to identity masking techniques.

What to do and how to stay safe: Kameleo

• Monitor authentication logs for unusual patterns, such as multiple accounts logging in from similar but slightly altered device fingerprints or proxy locations.
• Implement multi-factor authentication that is resistant to session hijacking, ensuring that stolen cookies alone do not grant full account access.
• Review browser security settings and keep software updated to mitigate risks associated with Browser-in-the-Middle attacks and fingerprint manipulation.
• Educate users on the signs of phishing attempts that could lead to their browser being used to create fraudulent profiles with residential proxies.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are antidetect browsers used for in criminal activities?

Criminals use antidetect browsers to create separate profiles with altered digital fingerprints, helping them operate thousands of fake accounts for fraud and advertising scams.

How does AI integration affect the use of these tools?

AI integration, such as AdsPower's MCP server, allows for automated browser tasks and content distribution, lowering the manual effort required to scale fraud operations.

Can these tools help attackers bypass login security?

Yes, Check Point notes that stolen session cookies can be loaded into profiles, allowing access to authenticated accounts without triggering conventional login events.