Most online security checks ask a simple question: is this the same person, on the same device, in the usual place? Banks, social networks and online shops compare dozens of small signals from your browser to answer it. A category of software called antidetect browsers is built to fake every one of those signals, and new research from Check Point shows how artificial intelligence (AI) is now turning them into a tool for fraud at industrial scale.
What Check Point found
In research published on 20 October, Check Point Research examined three commercial antidetect browsers: Kameleo, AdsPower and MultiLogin. These are legally registered products sold for digital marketing, e-commerce and privacy, and Check Point is careful to say so. Its concern is how they are being used once they reach criminal hands.
Each browser profile presents its own invented "fingerprint": screen size, fonts, graphics card details, time zone, language and more. Paired with a residential proxy, which routes traffic through ordinary home internet connections, every profile looks like a different person on a different device. Check Point says this lets a single operator run thousands of separate accounts on platforms such as Facebook, Instagram, TikTok, YouTube and LinkedIn without triggering the checks those platforms use to spot fake or coordinated accounts.
According to the research, AdsPower's published plans support up to 5,000 profiles, with larger arrangements on request, and the company advertises a 99.2% ban avoidance rate. MultiLogin says its product is tested daily against more than 50 platforms.
Where AI comes in
Antidetect browsers are not new. What has changed, Check Point argues, is automation. The tools now offer ready-made scripts that like, comment, message and follow across hundreds of profiles at once, "warm up" new accounts over several weeks so they look genuine, and, in AdsPower's case, a dedicated connection that lets AI models feed generated content straight into those accounts. In Check Point's words, running a large-scale social media operation "now requires only a credit card instead of a technical team".
Local experts see the same shift. Speaking to The National on 31 October, cybersecurity specialists said AI agents are letting criminals research victims, keep conversations going and run many scams at once with fewer people. The same report notes that Microsoft's Digital Defence Report ranks the UAE sixth in the world as a target of cyber attacks.
Why this matters to businesses, not just social networks
Fake accounts and influence campaigns make the headlines, but the part of the research most relevant to UAE companies is account takeover.
A stolen session needs no login. Check Point describes criminals taking session cookies stolen by information-stealing malware and loading them into a clean antidetect profile. The website sees an already signed-in user on a believable device, so no login takes place, no multi-factor authentication (MFA) code is requested and no alert is raised. We covered how stolen sessions bypass MFA in our article on stolen credentials and compromised vendors.
Phishing kits now pass the location test. The research describes phishing kits that create a fresh antidetect profile for each victim, with a home internet address in the victim's own country, and relay the victim's details to the real login page as they type. To the target service, the attempt looks local and normal.
Online checks can be beaten at sign-up. Check Point cites Anthropic's September threat report, which described a fraud campaign that combined antidetect profiles, residential proxies and identity-verification bypass tools to open large numbers of verified accounts at cryptocurrency exchanges and financial marketplaces. Any business that onboards customers online, runs a loyalty scheme or offers trade credit faces the same kind of abuse.
Your brand and ad budget are exposed. Networks of farmed accounts can impersonate a company, run fake customer support pages or generate fraudulent ad clicks that drain marketing spend.
The UAE is taking digital fraud seriously. In October, the Ministry of Interior led an international operation with Interpol and 30 countries that resulted in more than 900 arrests and uncovered USD 39 billion in illicit funds. On 31 October the UAE Cyber Security Council reminded the public never to approve login requests they did not start, never to share verification codes and to check regularly which devices are linked to their accounts.
What UAE and GCC organisations should do now
- Shorten and protect sessions. Keep session lifetimes short for email, finance and admin systems, ask users to sign in again before sensitive actions, and turn on token protection or device-bound session features where your platforms offer them.
- Monitor sessions, not just logins. Check Point advises reviewing whether your monitoring can spot a session that suddenly appears on a new device or network without a matching sign-in. Ask your security provider whether your tools can.
- Stop information stealers at the endpoint. Use modern endpoint protection, keep browsers updated, control which extensions staff can install and discourage saving work passwords in personal browsers.
- Move to phishing-resistant MFA. Passkeys and security keys are tied to the real website, so relaying a login through a fake page does not work. They are the strongest answer to the phishing kits described above.
- Do not rely on device fingerprints alone. If you run a customer portal, online shop or trade account system, add bot protection, rate limits and checks on unusual sign-up patterns, and require extra verification before payout or bank detail changes.
- Protect your brand online. Verify your official social media pages, monitor for look-alike accounts and tell customers which channels you genuinely use.
- Train staff on the basics. Follow the Cyber Security Council's advice: reject unexpected login prompts, never share codes, and confirm unusual requests through a known phone number or contact.
- Add these scenarios to your plans. Include session theft and fake-account abuse in incident response plans and security testing, as Check Point recommends.
Trust signals can be faked
Antidetect browsers show that the signals many systems rely on, a familiar device, a local address, a normal-looking account history, can now be manufactured cheaply and at scale. The answer is not to abandon those checks, but to add protections that cannot be copied so easily: device-bound sessions, phishing-resistant MFA, endpoint protection and a closer watch on what happens after someone signs in.
COMMPRO Technologies supplies identity, endpoint protection, email security and network security solutions from leading vendors across the UAE and GCC. If you would like help reviewing how your organisation protects logins, sessions and online accounts, contact our team.
