Identity

Antidetect browsers: one operator, thousands of fake users

By Yaali. October 27, 2026, 6 min read, Identity, Threat intel.

Check Point found Kameleo, AdsPower and MultiLogin abused for account takeover, fraud and fake-account farms. How they fool fingerprinting and what to log.

On October 20, Check Point Research published a report on antidetect browsers: tools that give every browser profile its own fake device, location and history, so one operator can run thousands of accounts that each look like a separate person. It names three products, Kameleo, AdsPower and MultiLogin, and found them referenced in underground forums and criminal marketplaces, used for account takeover, payment card fraud, fraudulent loan applications, ad fraud and fake-account farms for influence operations.

All three are commercial, legally registered products with real customers in digital marketing, e-commerce and privacy protection, and Check Point does not call them malware. The problem is what they do to defences. Any login page, sign-up form or checkout that decides "same device, same user" from a browser fingerprint is trusting a value these tools are built to forge. AdsPower now also ships a Model Context Protocol (MCP) server, which lets a large language model (LLM) drive the profiles, so writing and posting content across many accounts no longer needs a person at the keyboard.

How fingerprinting works, and how these tools fake it

A browser fingerprint is a set of values a site can read from the browser with a little JavaScript, combined into one identifier. The usual inputs:

• Canvas: the page draws hidden text and shapes, then hashes the pixels. Small differences in graphics card, driver and font rendering change the hash.
• WebGL: the graphics API reports a vendor and renderer string (for example a specific GPU model) and rendering quirks.
• Installed fonts, screen size, colour depth, CPU core count and memory.
• Time zone and language, read from the JavaScript Intl API and navigator.languages.
• WebRTC, the real-time media API, which can reveal the machine's real IP address even when the browser goes through a proxy.

Antidetect browsers fabricate each of these per profile. Check Point says MultiLogin isolates canvas, WebGL, fonts, time zone, screen resolution and user agent for each profile, with separate cookies and local storage. AdsPower keeps WebRTC, time zone, location and language consistent with the proxy assigned to the profile, and works with residential and rotating proxy services. Residential proxies route traffic through home broadband connections, so the IP belongs to an ordinary consumer ISP rather than a data centre.

Check Point groups this into five layers: device, network, session, behaviour and content. Most platform defences work at the account and behaviour layers. These tools work underneath them, so by the time a platform looks at what an account does, the account already appears to sit on its own unique laptop in the right city.

The session layer matters most for account takeover. Infostealers, malware that harvests saved passwords and cookies from an infected PC, copy the victim's session cookies. Loaded into a clean profile that matches the victim's region, the cookie lets the attacker into banking, crypto or email accounts with no password prompt and no multi-factor authentication (MFA) challenge, because to the service it looks like the same session continuing. No login event is written.

What attackers are doing with them

The report and Check Point's summary describe a working supply chain around these products:

1. An underground ad for an adversary-in-the-middle (AiTM) phishing engine offered to export harvested sessions straight into antidetect browsers.
2. A recruitment post advertised infostealer malware compatible with several antidetect platforms, built to collect session cookies and authentication tokens.
3. A proxy seller listed Kameleo alongside residential proxies as a complete package for account farming.

Check Point says the tools are discussed and advertised on Russian-language underground forums. Automation is part of the product. AdsPower's RPA (robotic process automation) Marketplace sells templates for liking, commenting, direct messages and follower scraping, including AI-assisted engagement. MultiLogin profiles can be scripted with Selenium, Playwright or Puppeteer, and the vendor also offers Android cloud phones driven over Android Debug Bridge (ADB). "Warming" tools build activity history on new accounts before they are used, so they pass the age and history checks platforms rely on.

For influence operations, the pipeline Check Point describes is an LLM writing posts, the MCP server pushing them into warmed profiles, and automation spreading them across accounts on Facebook, Instagram, TikTok, YouTube and X. It flags this as a growing concern ahead of elections.

What to do

Treat the fingerprint as one weak signal. The defences that hold up check whether the signals agree with each other, and link accounts that share infrastructure.

Bind sessions to the device that created them. Chrome on Windows now supports Device Bound Session Credentials (DBSC), which ties short-lived Google session cookies to a key held in the machine's Trusted Platform Module (TPM), so a copied cookie cannot be refreshed elsewhere. In Microsoft Entra ID, Conditional Access token protection only accepts device-bound sign-in tokens for supported apps; check Microsoft's documentation for which apps are still in preview. For your own web apps, issue short-lived session cookies and re-validate them against the client.

Alert on a session that changes hands. The cookie-injection takeover shows up as a session ID that continues with a new IP, ASN (the network operator behind the IP), user agent or TLS client fingerprint (JA3 or JA4) and no new login. Log those fields on every authenticated request, not only at sign-in. Entra ID Protection raises this as an "Anomalous token" risk detection; review those in the risky sign-ins report and revoke sessions for confirmed cases.

Check the fingerprint against itself. Forged values often disagree:

• Browser time zone that does not match the IP's geolocation, or Accept-Language that differs from navigator.languages.
• A WebGL renderer that cannot exist on the operating system in the user agent.
• A canvas hash that changes between two renders in the same session, which points to injected noise.
• WebRTC disabled or returning no candidates while the IP is a residential range.

None of these alone proves fraud, since privacy extensions cause some of them. Score them together.

Link accounts by what they share. Group sign-ups and logins by IP subnet and ASN, payment card, phone number, payout account and fingerprint components over a rolling window. Hundreds of accounts with different fingerprints that share a few residential subnets, or that all act within the same minutes, are a farm. Check Point gives platforms the same advice: judge connected activity across accounts rather than each profile on its own.

For actions that move money or control, require a fresh passkey or MFA check for payout or bank detail changes, new payees, email or phone changes, MFA resets and large withdrawals, whatever the session's age. Impossible-travel rules still help here: the same account active from two distant places within a short time.

Rate-limit account creation, login attempts and card tests per subnet, device cluster and payment instrument. Card testing through many "separate users" shows up as many small authorisations from new accounts sharing a BIN (the first digits of the card number) range.

If you find an account taken over this way, revoke all of its sessions and refresh tokens, not just the password, then check for changed recovery details, new payees or linked devices, and treat the user's own machine as infected with an infostealer until it has been cleaned.

Testing your own login and fraud controls

These tools are sold openly on subscription, so assume someone will point one at your sign-up page, checkout or customer portal. Testing whether a replayed session cookie or a forged fingerprint gets through is part of our web penetration testing, and session anomaly alerting is something we build and tune in security operations. To ask how your controls would handle it, open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Check Point Research, Check Point Blog, Check Point Threat Intelligence Report, October 26, TechRadar, GBHackers, Cryptika, AdsPower LocalAPI MCP server, Multilogin automation FAQ, Google Workspace Updates on DBSC, Microsoft Learn: token protection.