AI ‘anti-detection’ browsers are making scams, fraud and influence operations harder to detect
follow us
Add us as a preferred source on Google
- Cybercriminals use anti-detection browsers to disguise devices, hijack accounts, and evade fraud detection systems
- Stolen session cookies, fake identities, and AI automation help escalate scams and account abuse
- Researchers warn that AI-integrated anti-detection tools are lowering barriers to large-scale fraud operations
Cybercriminals have begun using anti-detection browsers as part of their technology stack, helping them evade detection while deploying session cookies, creating thousands of fake accounts, and passing Know Your Customer (KYC) checks. This is according to a new in-depth report published by security experts Check Point Research (CPR), which says that Russian, Iranian and Chinese hackers are spearheading these activities.
What are anti-detection browsers?
When users log in to services like Facebook or TikTok using regular browsers, they leave digital footprints: screen resolution, operating system, fonts. This information can be used to identify and track a device across online sessions, and if a single entity (for example, a digital marketing agency) attempts to log into multiple accounts from the same browser, it could trigger a security alert (or simply go against certain terms of service).
Hence the need for anti-detection browsers, specialized software whose key feature is the ability to create isolated profiles with different fingerprints, making multiple accounts appear to originate from separate devices.
Latest videos ofTechnologyRadar
They are typically used to manage social media accounts, advertising, and e-commerce accounts, or to run web scraping operations or test websites in different environments.
Antidetect browsers are non-malicious by design and are primarily used by digital marketing agencies and affiliate marketers. However, like many other good things, cybercriminals actively use these browsers to exploit the technology and run fraudulent accounts.
There are many competing tools available today, but a few stand out: Kameleo, AdsPower, Multilogin, GoLogin, and Dolphin Anty.
According to CPR, underground forums are filled with discussions about the use of anti-detection browsers for various fraudulent activities. These mainly come from Chinese, Iranian or Russian hackers and generally revolve around Kameleo, AdsPower and Multilogin.
“We specifically selected them based on documented references in underground forums and criminal markets, indicating active adoption beyond their stated commercial purposes,” CPR explained.
Analyzing these discussions, CPR discovered that threat actors primarily use anti-detection browsers to exploit stolen session cookies. When they steal a cookie, they can inject it into a clean browser profile to take over the account and operate it endlessly. Bank accounts and cryptocurrency wallets are the most popular targets.
AI Seasoning
In addition to banks and crypto wallets, threat actors also use these browsers to test payment credentials on e-commerce platforms without raising any alarms. They are also used to apply for loans with fabricated identities and to create fake accounts en masse, which are then used to generate advertising revenue at scale.
At the same time, Artificial Intelligence is making these operations easier to scale, says CPR. AdsPower, for example, offers integration with Large Language Models (LLM) through a Model Context Protocol (MCP) server, allowing AI-powered workflows to connect with browser profiles. Through automation marketplaces, it also offers different templates for things like commenting, liking, or messaging between multiple accounts.
A combination of browser anti-detection, AI account management, and AI-generated content creates a powerful mix that allows threat actors to execute large, coordinated campaigns with minimal involvement. This allows them to create and “warm up” fake accounts over time, which then appear more credible and easier to use in scam and fraud attacks.
“The anti-detection browser ecosystem represents a sophisticated, commercially mature, and increasingly AI-driven infrastructure that has fundamentally lowered the barrier to executing scam and fraud operations, as well as inauthentic coordinated operations at scale,” CPR warns. “These commercially maintained tools are available in dozens of languages, supported by customer support teams, tested daily on the world’s largest social media platforms, and are now integrated with LLM processes that remove the human operator from the execution layer.”
Researchers advise security teams to look beyond account behavior and focus on infrastructure, including residential proxy servers, inconsistencies in browser fingerprinting, and unusual session cookie patterns. Social media platforms should begin analyzing anti-detection browsers to better understand how they bypass their detection mechanisms, while businesses should review whether their security systems can detect account takeovers that involve session cookies.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment