- Check Point Research says antidetect browsers let one operator run thousands of isolated accounts that evade platform detection, and AI automation now removes much of the manual work.
- Check Point says the accounts can pass KYC checks and build normal histories, so behavior and device-based fraud tools often flag them only after fraud occurs.
- Leaders should ask whether fraud controls depend on device identity and early behavior, and what they add once an account looks legitimate.
Fraud checks ask one question, and the answer can be faked
Many fraud defenses start with a simple question. Have we seen this device before? Check Point Research has published a report on tools that make the answer "no" every time. They are called antidetect browsers.
The researchers say one person or a small team can run thousands of separate accounts with them. The accounts can sit on Facebook, Instagram, TikTok, YouTube, X, Discord, LinkedIn and Reddit. Check Point says platform detection systems do not trigger.
Here is the idea to hold onto. Device checks and early-behavior checks work only while identity can be trusted. These tools turn identity into a setting that anyone can change.
What Check Point found
Check Point studied three products: Kameleo, AdsPower and MultiLogin. It chose them because criminal forums and marketplaces mention them often. All three are legal commercial products. They have real uses in marketing, e-commerce and privacy.
The report also cites Anthropic's September 2026 Threat Intelligence Report. That report describes a fraud campaign against crypto exchanges and financial marketplaces. The attackers combined several tools. They used antidetect profiles and residential proxies, which are ordinary home internet addresses that hide where traffic really comes from. They also used automatic CAPTCHA solvers and tools that get around ID checks.
The result was a large number of verified accounts that skipped onboarding security. The accounts were later used for fraud.
Check Point says such accounts pass KYC (know-your-customer) checks. They also build normal-looking histories. Fraud tools that rely on behavior or device identity often cannot flag them until the fraud has happened.
How the tools work
Every browser shares dozens of small details with the sites it visits. Examples are how it draws graphics, which fonts it has, its screen size and its time zone. Together these form a fingerprint. Platforms use it to tell whether two accounts share one device.
Check Point says antidetect browsers fake each detail on its own. Every profile gets a different mix. To a platform, each account looks like a separate device.
The report describes more layers. Kameleo changes the browser engine itself, so its fingerprints come from real device signatures. It also blocks WebRTC, a protocol that can leak a real IP address even behind a proxy.
Kameleo also accepts full session cookies, including login tokens. A profile can start already signed in. No login event happens, so a fraud system has nothing to examine.
Check Point also describes Browser-in-the-Middle phishing. The phishing server tells the antidetect browser to build a profile for the victim. That profile gets a residential proxy in the victim's country. The victim types a password into a fake page. It is passed live to the real login page.
The real service then sees a familiar, local-looking device. It has no reason to ask for extra checks.
MultiLogin extends the idea to phones. Check Point says it offers cloud-hosted Android profiles in place of real handsets. Partners supply virtual phone numbers, so SMS checks work without physical SIM cards.
Where AI changes the economics
Antidetect browsers are not new. Check Point says manual effort held them back. Running large account networks took people.
The report says AI now removes much of that work. Content generation, persona management and fast distribution let one actor with a subscription and a prompt do a team's job.
AdsPower advertises plans of up to 5,000 profiles. It also advertises a Model Context Protocol server, a standard way to connect AI tools. Check Point says this lets AI-written content be made, placed into pre-warmed accounts and spread across platforms with no human involved.
Check Point says this reaches a scale and speed once tied only to state-sponsored actors. It adds that the same setup suits coordinated inauthentic behavior. That term means organized manipulation campaigns built on false identities.
The report says Meta's latest transparency reporting flagged this as a growing concern. Meta named Russia, Iran and China as the three leading sources.
What the report does not settle
The report excerpt we reviewed does not count how many fraudulent accounts exist. It does not say how often platforms catch them. Its evidence is forum posts, vendor documents and a cited third-party report.
That shows the tools are available and discussed. It does not show how often they succeed.
AdsPower advertises a 99.2% ban avoidance rate. That is a vendor claim, and the report does not test it.
Questions for your security and fraud teams
First, which of our fraud checks depend on device fingerprints or early account behavior? Check Point's findings suggest those signals can be faked.
Second, what do we do once an account looks legitimate? If the main controls sit at signup, an account that passes them may face little scrutiny later.
Third, do we watch for sessions that arrive already signed in, with no login event? Check Point describes cookie injection that produces exactly that pattern.
Fourth, are we covered for customers whose passwords are stolen through live phishing? A login from a clean local device may look routine.
The lesson is plain. When a subscription can manufacture a convincing identity, trust must be earned by what an account does over time. A clean look on day one is not enough.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Check Point Research.
