Hackers Use AI-Powered Browsers to Hide Thousands of Fake Accounts and Bypass Security Detection

Cybercriminals are using AI-enabled “antidetect” browsers to manage large networks of fake online accounts while making each profile appear to come from a different person, device, or location.

Check Point Research reported that these tools can help a single operator or small group run thousands of accounts across social media and other platforms, making it harder for services to spot linked activity.

The browsers have legitimate uses, but researchers documented their presence in criminal forums and marketplaces and described their use in fraud and account-takeover operations.

Analysts at Check Point Research identified Kameleo, AdsPower, and MultiLogin as three tools with features that can support this activity.

Their October 20, 2026 report says the platforms combine profile isolation and identity masking with automation, and in some cases AI integrations.

The report does not claim that the browsers themselves are malware; it warns that criminals can misuse commercially available software to conceal coordinated operations.

Hackers Use AI-Powered Browsers

A website can collect details about a browser and device, including screen size, time zone, language, user agent, and graphics settings.

Together, these details can help create a browser fingerprint. Platforms may compare fingerprints and activity patterns to identify accounts that appear to share a device or operator.

Check Point says antidetect browsers can change or assign different values to profiles, making that comparison more difficult.

The tools may also keep each profile’s cookies, local storage, and session information separate. Some can work with proxy services, which may make profiles appear to connect from different network locations.

That can complicate checks based only on an account’s IP address or location. Cybersecurity News has also described how residential proxies can hide malicious traffic, although proxy use alone does not prove that activity is criminal.

A more serious risk arises when criminals use stolen session cookies. A cookie can keep a user signed in after authentication; if it is stolen and reused, an attacker may access an active account without repeating the usual login process.

Check Point says criminals can place stolen session data into a browser profile, potentially making the session appear familiar to a service.

This is related to the risks in session-cookie theft and account takeover, where access to a logged-in session can undermine protections that focus on the initial sign-in.

AI and automation increase the scale

The report says AI features and automation can reduce the manual work needed to run many accounts. AdsPower, for example, advertises a Model Context Protocol (MCP) server for connecting large language model workflows to browser profiles.

The researchers describe a possible pipeline in which AI-generated text is paired with automated account activity and distribution. That does not mean every user of these products is conducting a campaign, but it can make coordinated misuse easier to scale.

Some platforms also offer templates for repetitive actions and tools to build activity histories over time. This “warming” can make a new profile look less like a newly created account.

Check Point warns that accounts may build credible histories or pass identity checks, which can delay detection until fraudulent activity begins.

Potential misuse includes account takeover, payment fraud, fake loan applications, advertising fraud, phishing, malware distribution, and coordinated efforts to influence online discussion.

The same concern applies to organizations whose staff accounts or customer accounts are targeted. A stolen session may be used to reach email, financial services, or other connected systems.

The Cybersecurity News report on Microsoft 365 session theft after MFA offers a related example of why security teams need to monitor active sessions, not just passwords and login challenges.

Check Point recommends looking beyond account behavior, because antidetect tools are designed to make individual profiles appear unrelated.

Security teams should review network and infrastructure signals, including large-scale residential proxy activity, unusual browser fingerprint changes, and suspicious session-cookie patterns. Organizations should also check whether their session monitoring can identify unusual access to an already authenticated account.

For platforms, account-level signals may still matter, but the report argues they should be combined with infrastructure analysis and investigation of suspicious patterns across profiles.

For companies, security reviews should include scenarios in which a valid session is used from an unexpected device or network, even when no new password prompt appears.

As with other session-hijacking methods, invalidating active sessions may be necessary when an account is confirmed compromised. The key point is that antidetect browsers are not a single malware family with one fixed signature.

They are tools that can mask identity signals, while automation and AI can help criminals operate at greater scale. Defenders therefore need to link signals across accounts, devices, networks, and sessions instead of relying on one indicator alone.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Use AI-Powered Browsers to Hide Thousands of Fake Accounts and Bypass Security Detection appeared first on Cyber Security News.