"Antidetect" browsers, combined with artificial intelligence, are helping hackers hijack accounts using stolen session cookies, according to a Check Point Research report reported on October 22, 2026. It is a concern for online fraud in Switzerland, where the National Cyber Security Centre reports that TWINT and e-banking accounts are being targeted.

The Check Point Research (CPR) report, summarised by TechRadar Pro, describes commercial tools misused by scammers. They are used to mask a device, take over accounts and create thousands of fake profiles. The researchers notably point to activity originating from Russia, Iran and China.

What is an "antidetect" browser?

A standard browser leaves a digital fingerprint with every connection. It includes the screen resolution, the operating system or the installed fonts. These details are often enough to recognise a device from one session to the next.

An "antidetect" browser, by contrast, creates isolated profiles, each with its own fingerprint. Several accounts thus appear to come from completely different devices. Without this tool, an agency managing several accounts from a single browser can trigger a security alert.

This software is not malicious by nature. Digital marketing agencies and affiliate marketing specialists use it to manage social networks, advertising campaigns or online shops. The best known are called Kameleo, AdsPower, Multilogin, GoLogin and Dolphin Anty.

Account hacking is the main use identified by CPR on underground forums. The discussions observed come from Russian-speaking, Iranian and Chinese actors. They focus mainly on Kameleo, AdsPower and Multilogin.

The technique relies on the session cookie, the small file that keeps a user logged in. The hacker injects the stolen cookie into a new browser profile. They then take control of the corresponding account without attracting attention. Bank accounts and cryptocurrency wallets are among the preferred targets.

The researchers describe other fraudulent uses of these browsers:

  • testing payment credentials on merchant sites without triggering an alert;
  • applying for loans under false identities;
  • getting past know-your-customer (KYC) checks;
  • mass-creating fictitious accounts, which are then used to generate fraudulent advertising revenue.

This workaround directly targets the online identification checks carried out by banks and cryptocurrency platforms.

What AI changes in cybercrime

Artificial intelligence (AI) takes this fraud to another scale, according to CPR. AdsPower, for example, offers integration with large language models (LLMs) through a Model Context Protocol (MCP) server. AI-driven automated processes can thus act on different browser profiles.

The software also offers ready-made templates for posting comments, handing out "likes" or sending messages from several accounts. With AI-generated content, a coordinated campaign then requires very little human intervention. Scammers can also create fake accounts and then keep them active gradually, so that they appear legitimate when the scam takes place.

The researchers sum up their findings in a blunt statement: "The antidetect browser ecosystem represents a sophisticated, commercially mature and increasingly AI-driven infrastructure that has considerably lowered the barriers to setting up scams." According to them, these tools have support teams, are available in dozens of languages and are now plugged into LLMs, "which make it possible to remove the human operator from the execution phase."

Online fraud in Switzerland: what the NCSC reports

In Switzerland, the National Cyber Security Centre (NCSC) is also seeing account takeovers. On October 20, 2026, it described a new phishing variant linked to hotel bookings. These scams mainly targeted credit cards. In recent cases, the scammers are also trying to take over TWINT and e-banking accounts.

Businesses expect a rise in AI-related cybercrime. According to Mobiliar's "SME Cybersecurity 2026" study, published by the NCSC on October 22, 2026, four out of five Swiss small and medium-sized enterprises (SMEs) anticipate it. The study notes that many are well protected on the technical side but need to improve on the organisational side.

The risk is not theoretical for these businesses. According to the magazine PME, cited in our article on the cyberattack on pension funds, one in three Swiss SMEs has already suffered a cyberattack.

The NCSC receives voluntary reports from the public, businesses and authorities. Operators of critical infrastructure, for their part, have been required to report their cyber incidents to it since April 1, 2025. The same week, the office also issued a warning about the PHP2Shell PHP vulnerability, which affects web servers.

Our analysis: the phishing described by the NCSC and the stolen cookies described by CPR follow different paths. Yet they aim for the same result: an account that is already open, used without its holder's knowledge.

How to protect your accounts: sessions, two-factor authentication, alerts

The NCSC publishes a step-by-step guide for when an account has been hacked. It starts from one observation: the theft is often discovered when it is already too late. Several steps help to spot an intrusion earlier and stop it:

  • check login attempts made from unusual locations or at unusual times; Apple, Google or Microsoft send a notification in such cases;
  • beware of fake access alerts: never click the link in such an email, but type the service's address yourself;
  • enable two-factor authentication wherever possible;
  • update the system and applications, then run an antivirus scan, as hackers also steal data with malware;
  • for a bank account or financial service, contact the provider immediately, have the cards blocked and check your statements;
  • for an email account, delete any rule that forwards emails, then change the passwords of linked services;
  • file a complaint with the cantonal police in the event of financial loss.

Not all login methods are equal. On October 19, 2026, the NCSC published a classification in five levels, from "low" to "high". It is based on the assurance levels of the US National Institute of Standards and Technology (NIST). The office adapted it to include protection against real-time phishing. It is not a certification, but a reference for choosing a solution.

Our analysis: a session cookie corresponds to a connection that has already been established. Closing your sessions after use and monitoring active connections therefore reduces the time during which a stolen cookie remains usable.

What this means for an SME

CPR advises security teams to stop monitoring account behaviour alone. The researchers recommend also examining technical infrastructure:

  • residential proxies;
  • inconsistencies in browsers' digital fingerprints;
  • unusual behaviour linked to session cookies.

Businesses should also check that their systems detect account hijacking based on these cookies. Our analysis: for an SME running an online shop, the payment credential testing described by CPR concerns it directly, since merchant sites are what fraudsters use as a testing ground.

What we don't know yet

The summary of the report published by TechRadar Pro does not put a figure on the number of hijacked accounts, nor on the losses. It gives no data specific to Switzerland. The NCSC pages consulted do not say either what share of hacked accounts in Switzerland were compromised through a stolen session cookie. Finally, the summary does not indicate how the publishers of these browsers are responding to fraudulent uses of their tools.

Sources