Criminals have started using antidetect browsers, software built to make one computer look like many, to hijack accounts and run fraud at scale, according to Check Point Research (CPR).
CPR studied underground forum and criminal marketplace discussions and found that Russian, Iranian, and Chinese hackers are leading the activity. Most of the talk centers on Kameleo, AdsPower, and Multilogin, which CPR picked because they are repeatedly referenced in those spaces. GoLogin and Dolphin Anty are also among the better-known tools.
The browsers work by creating isolated profiles, each with its own fingerprint: screen resolution, operating system, fonts. Marketing agencies and affiliate marketers use them to manage many accounts without tripping alarms. Criminals use them mainly to exploit stolen session cookies, the small files that keep a user logged in. Injected into a clean profile, a stolen cookie lets an attacker take over the account. Banking accounts and crypto wallets are the favorite targets.
CPR also found the browsers being used to test payment credentials across e-commerce sites, apply for loans under fabricated identities, pass Know Your Customer (KYC) checks, and create fake accounts in bulk for advertising revenue.
The AI layer is the newer part. AdsPower offers a Model Context Protocol (MCP) server, which lets large language models connect to browser profiles, and its automation marketplace sells templates for commenting, liking, and messaging across many accounts. CPR says this lets operators build up fake accounts over time with minimal involvement. CPR did not say how widely criminals use these AI features.
The cookie angle explains why this matters. A stolen cookie is already a logged-in session, so the attacker never needs the password, and a separate fingerprint makes that session look like an ordinary device. Because the software is sold openly for routine marketing work, the tool itself is a poor signal for defenders.
CPR advises security teams to look at infrastructure rather than account behavior: residential proxies, fingerprint inconsistencies, and unusual session-cookie patterns. It also urges platforms to study how these browsers bypass their detection. Whether infrastructure signals hold up once AI makes the behavior look human too is the open question.