All public cases of hacks, leaks, and theft involving antidetect browsers that we found: what happened, who was affected, how much was lost, and what the company did. Our editors collected and checked the sources of every case.
MoreLoginSupply chain attack
Vulnerability fixed, payouts without admission of liability
On March 17, 2026, MoreLogin users began reporting cryptocurrency theft.
Who was affected
101 reports
Losses
≈ $85K
Octo BrowserUser account takeover
Company says the service was not hacked
On February 12, 2026, Octo Browser reported on its blog that attackers had logged into several users’ accounts and gained access to their profiles.
Who was affected
several accounts
Losses
not reported
Vulnerability fixed, no compensation reported
From January 21 to 24, 2025, crypto wallet extensions that users installed or updated in AdsPower were replaced with malicious versions.
Who was affected
> 34,000 wallets
Losses
≈ $4.7 million
Antik BrowserAttack with no confirmed breach
Company did not publish the outcome of the attack
On September 19, 2023, Antik Browser announced through its official channels that, according to its logs, someone was attempting to access users’ accounts by brute-forcing usernames and passwords.
Who was affected
not reported
Losses
not reported
BitBrowserService data leak
Vulnerability fixed, no compensation reported
At the end of August 2023, BitBrowser users began reporting stolen private keys and funds from their crypto wallets.
Who was affected
> 3,000 wallets (media reports)
Losses
at least $410K (SlowMist)
IncognitonUser account takeover
Company says the service was not hacked
On August 1, 2023, Incogniton reported in its official Telegram channels that some users had funds stolen from their crypto wallets after their Incogniton login credentials were stolen.
Who was affected
some users
Losses
amount not disclosed
Vulnerability fixed, losses compensated
On July 18, 2022, Dolphin {anty} reported in its official channel that browser profiles had been leaked from its cloud storage. According to the company, around 15% of all profiles were compromised.
Who was affected
≈ 15% of profiles
Losses
amount not disclosed
Dolphin {anty}Attack with no confirmed breach
Company did not publish the outcome of the attack
On November 3, 2021, Dolphin {anty} reported that attackers were trying to guess users’ account passwords.
Who was affected
unknown
Losses
not reported
No cases match this filter.
Not a service hack: brand impersonation, unverified complaints, patched vulnerabilities, and DDoS attacks. They are not counted as incidents.
GoLogin
From January through December 2025, users wrote in reviews that, after using GoLogin, attackers accessed their Facebook ad accounts and ran ads at their expense. They suspected that cookies from their profiles had been leaked or sold. The authors reported losses ranging from $3,000 to $100,000, but these figures cannot be verified. In May 2025, GoLogin responded to the January–April reviews, saying it had found no signs that the service had been compromised and attributing the incidents to account providers and 2FA services, leaked passwords, phishing, and dishonest team members. There was no response to the November–December 2025 reviews. In March 2025, GoLogin introduced email alerts about logins from a new IP address. There is no independent confirmation.
On July 31, 2021, GoLogin reported a DDoS attack: the service was unstable, and according to the company, the requests originated from Singapore. Service was restored by that evening, while the API for trial accounts was disabled until Monday. On November 25, 2021, the company reported another DDoS attack, apologized, and issued promo codes for +1 and +3 days of subscription time. No data leak was reported.
When it launched the official support bot @GoLoginSupportBot, the company warned that there are many scammers on Telegram and asked users to access support only through the link in its official channel.
Octo Browser
In the May 20, 2022 browser engine update, the company said it had fixed an IP leak via WebRTC when using certain IPv6 proxies. It did not specify whose address was exposed or how many users were affected; no abuse was reported.
Multilogin
Fake websites, Telegram “support” channels, and email campaigns operated under the Multilogin name. In autumn 2021, Zscaler found multilogin-uk and multilogin-us copycat websites distributing an installer bundled with an infostealer. The stealer collected saved passwords, cookies, and autofill data from browsers and sent them to the attackers’ Telegram bot. In March 2026, the company warned about suspicious emails sent in the name of Multilogin and its employees and published a list of its email domains. The service itself was not hacked; its official website is multilogin.com.
The service was hit by DDoS attacks for several weeks, causing brief outages for some users. According to the company, the attacks targeted availability rather than data, and it has since added a new layer of DDoS protection. The company previously reported a DDoS attack on its CDN in February 2018.
On October 8, 2020, Multilogin reported that the service had recently been targeted in an attempt to disrupt its operation. The company described it as an act of unfair competition. That same day, it tightened its limits, said the attacks had been repelled, and apologized for the disruptions. In the same post, it mentioned that earlier attacks had mainly targeted user accounts through password guessing and social engineering. The company did not say when this happened or whether anyone had managed to access another user’s account.
The company fixed WebRTC masking issues that could expose a profile’s real IP address: in November 2023, in the Mimic 119 and Stealthfox 120 browser engines; and in March 2024, a public IPv6 leak in Mimic 122.9 that occurred when a site had permission to access the camera or microphone. No attacks exploiting these issues have been reported.
The company has issued two warnings about scammers impersonating its support team: in April 2023, it warned about fake social media accounts, and in July 2024, about people charging users while posing as company employees. The company says its official support team never asks for money, and all payments are made only through the website.
AdsPower
Fake websites and installers were distributed under the AdsPower name. In 2022, the company warned about the phishing site ads-power.org, which hosted an infected version of the program. In December 2025, it reported that it had gotten more than ten fake websites taken down. In July 2026, it said that since the end of October 2025, it had identified 37 suspicious websites and reported them to registrars and hosting providers. The official addresses are adspower.com, adspower.net, and the Russian-language adspower-ru.com.
Since August 13, 2024, AdsPower has run a public bug bounty program. Reports are accepted at [email protected], and the scope covers *.adspower.com, *.adspower.net, and the client application. According to the company, before launching the program, it worked with the Huoxian platform to identify and fix dozens of vulnerabilities and paid researchers around $6,000. We found no reports that these vulnerabilities had been exploited.
The company stated that it had passed a SOC 2 Type II audit. According to the company, an independent auditing firm issued the report based on AICPA criteria covering a 12-month period, with no qualifications. The auditor’s name and the report itself have not been disclosed. AdsPower’s homepage also mentions ISO 27001 and ISO 27701 certificates, but we have not seen the certificates themselves.
Afina
In April 2025, Afina warned users in its official channel that they might be tricked into downloading a fake version of the program and posted the SHA256 hashes of its installers. The next day, the channel administrator mentioned someone who had downloaded “something resembling the official program” and could not remove it. The public channel did not specify what the file was or where it came from. In May 2026, the company pinned a list of official contacts, including Discord and the @Afina_support_bot bot, and urged users to beware of impostors.
RoxyBrowser
According to the company, RoxyBrowser obtained ISO 27001 certification in February 2025 and completed a SOC 2 Type II audit in November 2025. The company does not disclose the auditor or certificate numbers, and we found no independent confirmation.
BitBrowser
The company has warned about fake copies of its website that are used to steal login credentials and payment details. Their installers may also be infected. The notice identifies bitbrowser.net, bitbrowser.cn, and bitbrowser.ru as the official websites. According to WHOIS, bitbrowser.ru was registered by a private individual on October 9, 2026.
In version 1.4.1, the company fixed a permissions vulnerability that allowed team members to exceed the access rights granted to them. No exploitation was reported.
GeeLark
The company warned that fake accounts and channels impersonating it had appeared on Telegram and published a list of the official ones: @geelarknewsen, @geelark, @geelarkvn, and the support bot @GeeLarkSupport_bot. GeeLark has not reported any affected users.
Vision
The company warned users about scammers: payments can be made only through the account dashboard on the website, and Vision does not send discount offers from other accounts. It did not report any specific cases.
Linken Sphere
In January 2019, the ANY.RUN sandbox analyzed a file named LinkenSphere.exe and flagged it as malicious. According to the report, the program stole credentials and read Chrome and Firefox cookies. The report does not say who distributed the file or where it came from, and it does not establish any connection to official builds. Since 2023, the company itself has warned about counterfeit versions and fake support, stating that its employees never contact users first or ask them to transfer money to personal wallets. It recommends reaching out through the in-app chat or the @sphere_help_bot bot.
MoreLogin
In October 2023, SlowMist conducted a black-box audit of MoreLogin, specifically its airdrop version (MoreLogin AirDrop), according to the company. The report was published in SlowMist’s public GitHub repository on November 8, 2023. We have not verified the report’s findings.
Since September 2024, MoreLogin has run a bug bounty program on the BugRap platform, offering between 1,000 and 1,500 USDT for critical vulnerabilities in its Windows and macOS clients.
Kameleo
In version 5.2.0 (August 31, 2026), the company listed as a security fix the change that hides proxy passwords in API responses. It did not disclose further details, and there were no reports of exploitation. The announcement was published on September 4 alongside version 5.2.1.
On August 27, 2026, the company updated the Chroma 152 and Junglefox 153 browser engines, followed by another Chroma 152 update on September 1. According to the company, these updates fixed a potential real IP leak through WebRTC when using a proxy. In version 5.3.0, released on September 28, UDP traffic from HTTP/3 and QUIC in Chroma 152 and later was routed through SOCKS5 proxies “to prevent IP leaks.” The company did not disclose how many profiles were affected, and no exploitation was reported.
In May 2021, the company warned that scammers on Telegram were posing as Kameleo. It clarified that its only Telegram channel is @kameleoapp, it does not offer support via Telegram, and Kameleo should only be purchased and downloaded from kameleo.io. No victims were reported.
Dolphin {anty}
In February and April 2022, the service experienced disruptions due to attacks on its servers. In December 2022, the interruptions were caused by a DDoS attack. According to the company, its website was intermittently targeted by DDoS attacks for about three months in 2023, but the browser itself was not affected. The company did not report any data compromise. Paid users received bonus days: one day in February 2022 and two days in December 2022.
The company warned that there are only two official websites, dolphin-anty.com and its mirror, dolphin-anty.net. It also asked users not to enter their data on lookalike websites and to report them to support. No specific fake websites were named.
Incogniton
The company has warned about impersonators using its name: in January 2021, it said that it had no Telegram channels other than the official one; in October 2022, it reported “many attempts” to impersonate its websites, channels, and support contacts. At the same time, it published a list of official addresses. It did not report any victims.