Academy
TermUnderground market

Antidetect browser

A browser that imitates a different device, operating system and browser fingerprint for each profile; used to open stolen sessions in an environment resembling the victim’s device.

Flow

  1. 1Profile set up
  2. 2Cookies loaded
  3. 3Connection routed
Related families
Lumma Stealer
MITRE ATT&CK
T1550.004 · Web Session Cookie
Sources
4 sources
01

Overview

Websites try to tell whether a session comes from a familiar device using the browser fingerprint (screen, fonts, language, time zone, hardware details). An antidetect browser changes these values per profile. MITRE ATT&CK

Once stolen cookies are loaded into such a profile, the attacker tries to continue the victim’s session without a new login. MITRE ATT&CK

02

How it works

  1. 1

    Profile set up

    Operating system, language and screen values matching the system information in the log are chosen.

  2. 2

    Cookies loaded

    Session cookies from the log are imported into the profile. MITRE ATT&CK

  3. 3

    Connection routed

    The site is accessed through a proxy in the victim’s country.

03

Real-world examples

Lumma: collecting browser fingerprints

Lumma Stealer profile

Trend Micro documented that the version of Lumma rebuilt in 2025 also started collecting the victim’s browser fingerprint. Trend Micro

04

How to detect it

  • The same session cookie being used within a short time with a different country, network or device characteristic. MITRE ATT&CK
05

What to do

  • Use device-bound sessions and phishing-resistant multi-factor authentication; require re-authentication when risk changes. MITRE ATT&CK
06

MITRE ATT&CK

T1550.004Web Session CookieT1539Steal Web Session Cookie
07

Related families and terms

Families

Lumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

Session hijackingStealer logsHardware ID
08

Sources

  1. 1Web Session Cookie (T1550.004) · MITRE ATT&CK
  2. 2Steal Web Session Cookie (T1539) · MITRE ATT&CK
  3. 3Lumma Stealer browser fingerprinting · Trend Micro, 2025
  4. 4Multi-factor Authentication (M1032) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans