Check Point Research's Oct 20 report looks at three commercial antidetect browsers, Kameleo, AdsPower and MultiLogin, which fake per-profile browser fingerprints (canvas, WebGL, fonts, time zone, WebRTC) so one operator can run thousands of isolated accounts across Facebook, TikTok, Instagram, YouTube, X and others. Check Point documents underground-forum use: session cookies from infostealers injected into clean profiles to take over bank and crypto accounts with no login event, carding, fraudulent loan applications, Browser-in-the-Middle phishing kits that list Kameleo as a component, and an AiTM service that exports stolen sessions straight into antidetect browsers.

The AI angle: AdsPower advertises a dedicated Model Context Protocol server, an RPA marketplace with AI-assisted engagement templates, and cookie-warming automation. Check Point says that creates a pipeline from LLM-generated content to pre-warmed accounts at machine speed, which matters ahead of elections. The tools are legal, commercially sold products with legitimate marketing uses. The report describes what the tools can do and how they're discussed on forums. It doesn't attribute specific campaigns to them, beyond citing Anthropic's September threat report on fraud that used antidetect profiles.

For defenders: account-layer and behavioral signals are what these tools are built to beat. Check Point suggests infrastructure-layer signals (residential proxy pools at scale, WebRTC suppression, cookie-injection sequences, known antidetect user agents). It also suggests checking whether your session monitoring can spot a pre-authenticated session appearing with no login, which is how cookie theft bypasses MFA.