Antidetect brauzer vositalari — alohida brauzer profillarini o'zgartirilgan raqamli barmoq izlari bilan yaratadigan vositalar — firibgarlarga minglab go'yoki bir-biriga bog'liq bo'lmagan ijtimoiy tarmoq akkauntlarini boshqarishda yordam berishi mumkin.
Tadqiqot Kameleo, AdsPower va MultiLogin — marketing, elektron savdo va maxfiylikni himoya qilishda qonuniy foydalanish sohalariga ega bo'lgan tijorat platformalariga qaratilgan.
Tadqiqotchilar shuningdek, ushbu vositalarni akkauntni egallab olish, to'lov firibgarligi, soxta kredit arizalari va reklama firibgarligi uchun akkauntlarni ommaviy yaratish bilan bog'liq jinoiy forumlar va bozorlarda ham topganliklarini aytishdi.
Brauzer barmoq izi — bu veb-sayt bir qurilma yoki brauzerni boshqasidan ajratish uchun foydalanishi mumkin bo'lgan texnik signallarning to'plami. Bunga ekran o'lchami, vaqt zonasi, shriftlar, user-agent ma'lumotlari va Canvas yoki WebGL natijalari kirishi mumkin.
Antidetect brauzerlar foydalanuvchilarga alohida profillarni sozlash imkonini beradi, shunda bu signallar turli akkauntlar orasida farqli ko'rinadi. Proksi xizmatlari bilan birlashtirilganda, profillar turli tarmoq joylaridan ulanishdek ham ko'rinishi mumkin.
Bu akkaunt, qurilma va xulq-atvor signallarini korrelyatsiya qilish orqali muvofiqlashtirilgan suiiste'molni aniqlaydigan platformalar uchun qiyinchilik tug'diradi.
Vositalar akkauntlarni mutlaqo ko'rinmas qilmaydi, lekin ular ba'zi keng tarqalgan identifikatsiya signallarini kamroq ishonchli qilishi mumkin.
Sun'iy intellekt bu operatsiyalarni boshqarishni osonlashtirishi mumkin. AdsPower o'zining Local API'siga AI tizimlarini ulaydigan va brauzer-avtomatlashtirish vazifalarini qo'llab-quvvatlaydigan MCP serverini reklama qiladi.
Check Point aytishicha, o'g'irlangan sessiya cookie fayllari ham brauzer profillariga yuklanishi mumkin, bu esa jinoiy shaxslarga an'anaviy kirish hodisasini ishga tushirmasdan allaqachon autentifikatsiya qilingan akkauntga kirish imkonini berishi mumkin.
Check Point Research aytishicha, bu mahsulotlar identifikatsiyani yashirishni avtomatlashtirish va AI integratsiyalari bilan birlashtirganda, akkaunt firibgarligi va muvofiqlashtirilgan ta'sir kampaniyalarini kengaytirish uchun zarur bo'lgan sa'y-harakatni kamaytirib, xavf o'sib bormoqda.
MCP, ya'ni Model Context Protocol — AI modellarini tashqi vositalar va xizmatlarga ulash uchun standart. Check Point ogohlantirishicha, AI tomonidan yaratilgan kontent avtomatlashtirish bilan birlashganda, operatorlarga materialni kamroq qo'lda ish bilan bir nechta profillar bo'ylab tarqatishda yordam berishi mumkin.
Rus tilidagi yer osti xakerlik forumidagi post — Kameleo-ni Browser-in-the-Middle fishing to'plamlarining komponenti sifatida tanishtiradi (Manba: Check Point).
Browser-in-the-Middle hujumida, fishing serveri antidetect brauzerga jabrlanuvchi uchun yangi profil yaratishni, ularning mamlakatidagi turar-joy proksisi va toza qurilma barmoq izi bilan tayinlashni buyuradi.
Akkount muharriri ijtimoiy tarmoqlar, elektron savdo, moliyaviy xizmatlar va professional tarmoqlarni, jumladan Facebook, Amazon, LinkedIn, X, PayPal va Google'ni qamrab olgan platformalarni qo'llab-quvvatlaydi.
AdsPower narxlar jadvali mo'ljallangan operatsion miqyosni aks ettiradi, korporativ darajalar so'rov bo'yicha 5 000 dan ortiq profillarni qo'llab-quvvatlaydi (Manba: Check Point).
Sarlavhadagi Gemini bilan mos keladigan brauzerlar haqidagi havola moslik muammosi sifatida tushunilishi kerak, bu Google'ning Gemini mahsuloti o'zi zararli ekanligi yoki tadqiqotchilar aniq Gemini tomonidan boshqariladigan kampaniyani ko'rsatganligi haqida dalil emas.
AdsPower hujjatlari Claude Desktop, Cursor va boshqa mos keladigan vositalar uchun MCP qo'llab-quvvatlashini tasvirlaydi; ko'rib chiqilgan materialda Gemini nomi tilga olinmagan.
AdsPower'ning o'z sayti ham AI agentlari va avtomatlashtirish skriptlari bilan integratsiyalarni reklama qiladi.
Tadqiqotchilar bu vositalar atrofidagi kengroq jinoiy ekotizimni tasvirlaydi. Ularning hisoboti o'g'irlangan sessiya ma'lumotlarini antidetect brauzerlarga eksport qiladigan hisob ma'lumotlarini yig'ish xizmatlari, shuningdek, bir nechta brauzer platformalari bilan mos keladigan zararli dasturiy ta'minot reklamalari haqidagi yer osti e'lonlarini keltiradi.
Potensial oqibatlar fishing va akkaunt o'g'irlashdan tortib, firibgarlik tranzaksiyalari va onlayn muhokamani manipulyatsiya qilishga qaratilgan muvofiqlashtirilgan sa'y-harakatlargacha cho'ziladi.
Xavf faqat ijtimoiy tarmoqlar bilan cheklanmaydi. Check Point aytishicha, hujumchilar kriptovalyuta birjalari va moliyaviy bozorlarga qaratilgan kampaniyada antidetect profillar, turar-joy proksilari, CAPTCHA yechish va identifikatsiyani tekshirishni chetlab o'tish vositalaridan foydalangan, Anthropic'ning 2026-yil sentyabr oyidagi tahdid razvedkasi hisobotiga havola qilib.
Onboarding tekshiruvlaridan o'tgan va go'yoki normal faoliyat tarixini rivojlantirgan akkauntlar suiiste'mol qilinishidan oldin aniqlanishi qiyinroq bo'lishi mumkin.
Check Point ta'kidlaydiki, dasturiy ta'minot qonuniy qo'llanmalarga ega; xavf jinoiy shaxslar uning xususiyatlarini o'g'irlangan hisob ma'lumotlari, proksilar va avtomatlashtirish bilan birlashtirishida yotadi.
Tashkilotlar uchun tadqiqotchilar bitta akkaunt faoliyatidan tashqariga qarashni va infratuzilma va sessiya signallarini, jumladan keng ko'lamli proksi foydalanishi, g'ayrioddiy sessiya-cookie faoliyati va oldindan autentifikatsiya qilingan kirish belgilarini ko'rib chiqishni tavsiya qiladi.
Shuningdek, ular qurilma izchilligiga kuchli bog'liq bo'lgan firibgarlik nazoratlarini qayta baholashni maslahat berishadi.
Asosiy xavotir — miqyosdagi o'zgarish: avtomatlashtirish ko'plab onlayn identifikatsiyalarni boshqarish uchun zarur bo'lgan vaqt va tajribani kamaytirishi mumkin.
Ammo tadqiqotchilarning topilmalari antidetect brauzerdan foydalanadigan har bir foydalanuvchi zararli harakat qilayotganini anglatmaydi, shuningdek, AI o'zi platforma himoyalarini chetlab o'tishi mumkin emas.
Ogohlantirish shuki, identifikatsiyani yashirish vositalari va AI yordamidagi ish oqimlari, jinoiy infratuzilma bilan birlashtirilganda, muvofiqlashtirilgan firibgarlik va manipulyatsiyani aniqlashni qiyinlashtirishi mumkin.
Antidetect browsers tools that create separate browser profiles with altered digital fingerprints could help scammers operate thousands of apparently unrelated social media accounts.
The research focuses on Kameleo, AdsPower and MultiLogin, commercially available platforms with legitimate uses in marketing, e-commerce and privacy protection.
Researchers say they also found the tools referenced in criminal forums and marketplaces in connection with account takeovers, payment fraud, fake loan applications and bulk creation of accounts for advertising fraud.
A browser fingerprint is the collection of technical signals a website can use to distinguish one device or browser from another. These can include screen resolution, time zone, fonts, user-agent details, and Canvas or WebGL output.
Antidetect browsers let users configure separate profiles so those signals appear different across accounts. When combined with proxy services, the profiles can also appear to connect from different network locations.
This creates a challenge for platforms that identify coordinated abuse by correlating account, device and behavior signals.
The tools do not make accounts inherently invisible, but they can make some commonly used identity signals less reliable.
Artificial intelligence could make these operations easier to run. AdsPower advertises an MCP server that connects AI systems to its Local API and supports browser-automation tasks.
Check Point says that stolen session cookies can also be loaded into browser profiles, potentially allowing criminals to access an already authenticated account without triggering a conventional login event.
Check Point Research said that, the risk is growing as these products combine identity masking with automation and AI integrations, lowering the effort needed to scale account fraud and coordinated influence campaigns.
MCP, or Model Context Protocol, is a standard for connecting AI models to external tools and services. Check Point warns that AI-generated content combined with automation could help operators distribute material across multiple profiles with less manual work.
A post on a Russian-language underground hacking forum introducing Kameleo as a component of Browser-in-the-Middle phishing kits(Source : Check Point).
In a Browser-in-the-Middle attack, the phishing server instructs the antidetect browser to create a new profile for the victim, assigned a residential proxy in their country and a clean device fingerprint.
Account editor supports platforms spanning social media, e-commerce, financial services, and professional networks including Facebook, Amazon, LinkedIn, X, PayPal, and Google.
AdsPower’s pricing table reflects the intended operational scale, with enterprise tiers supporting more than 5,000 profiles available upon request (Source : Check Point).
The headline’s reference to Gemini-compatible browsers should be understood as a compatibility concern, not as evidence that Google’s Gemini product is itself malicious or that the researchers demonstrated a specific Gemini-driven campaign.
AdsPower’s documentation describes MCP support for Claude Desktop, Cursor and other compatible tools; it does not name Gemini in the material reviewed.
AdsPower’s own site also advertisesintegrations with AI agents and automation scripts.
The researchers describe a broader criminal ecosystem around these tools. Their report cites underground advertisements for credential-harvesting services that export stolen session data to antidetect browsers, as well as malware advertised as compatible with multiple browser platforms.
The potential consequences extend from phishing and account theft to fraudulent transactions and coordinated efforts to manipulate online discussion.
The threat is not limited to social networks. Check Point says attackers used antidetect profiles, residential proxies, CAPTCHA-solving and identity-verification bypass tools in a campaign targeting cryptocurrency exchanges and financial marketplaces, citing Anthropic’s September 2026 threat-intelligence report.
Accounts that pass onboarding checks and develop a history of apparently normal activity may be harder to flag before they are abused.
Check Point emphasizes that the software has legitimate applications; the risk lies in how criminals combine its features with stolen credentials, proxies and automation.
For organizations, researchers recommend looking beyond a single account’s activity and reviewing infrastructure and session signals, including large-scale proxy use, unusual session-cookie activity and signs of pre-authenticated access.
They also advise reassessing fraud controls that depend heavily on device consistency.
The central concern is a change in scale: automation can reduce the time and expertise needed to manage many online identities.
But researchers’ findings do not mean every user of an antidetect browser is acting maliciously, nor that AI alone can bypass platform defenses.
The warning is that identity-masking tools and AI-assisted workflows, when combined with criminal infrastructure, can make coordinated fraud and manipulation harder to detect.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.