Reverse Engineering Multilogin: How 'Paste as Human' and Blink C++ Commits Leak Mimic and Stealthfox
How Multilogin's proprietary pasteAsHuman command in Blink C++ and impossible Stealthfox Gecko kernel versions expose Mimic and Stealthfox profiles.
- ✔ Multilogin registers 'pasteAsHuman' in Blink's clipboard commands table, detectable in one line of JS.
- ✔ Stealthfox injects Edge and WebKit PDF plugins into Firefox's Gecko engine.
- ✔ Spoofs impossible Windows NT 11.0 kernel version into navigator.oscpu.
- ✔ Mimic passes future Darwin 26.4 kernel versions on macOS profiles via Client Hints.
Reverse Engineering Multilogin: How "Paste as Human" and Blink C++ Commits Leak Mimic and Stealthfox
Multilogin is one of the oldest and most expensive anti-detect browser platforms on the market. With subscriptions running from hundreds to thousands of dollars per month, users expect near-military-grade stealth.
Multilogin maintains two proprietary browser engines:
- Mimic: Their customized Chromium fork
- Stealthfox: Their customized Mozilla Firefox (Gecko) fork
While Multilogin does a reasonable job at high-level profile management, a deep look into their C++ modifications reveals jaw-dropping detection artifacts.
In this post, we will walk through how Multilogin accidentally created a one-line JavaScript detection vector through its "Paste as Human" feature, and how both Mimic and Stealthfox leak their identities through engine contradictions.
# 1. The "Paste as Human" C++ Leak in Mimic (Chromium)
One of Multilogin's signature user-facing features is "Paste as Human." Instead of pasting text instantly via the standard OS clipboard paste event, it types out clipboard text with realistic keystroke intervals to fool behavioral bot detection.
To implement this across all web inputs, Multilogin's engineers made a critical mistake: they modified Blink's native editing command dispatch table in C++.
Inside Chromium's source tree, Blink handles clipboard and text editing commands in:
thirdparty/blink/renderer/core/editing/commands/clipboardcommands.cc
Standard browsers support commands like copy, cut, paste, selectAll, and undo.
To support their feature, Multilogin registered a custom command identifier: "pasteAsHuman".
Because this command is registered directly in Blink's command table, the DOM method document.queryCommandSupported() exposes it to any JavaScript running on any website:
document.queryCommandSupported('pasteAsHuman')The Invariant
- ◆In genuine Google Chrome:
false - ◆In Safari, Firefox, Edge, Brave, Opera:
false - ◆In Dolphin{anty}, AdsPower, Octo:
false - ◆In Multilogin Mimic:
true
With a single, standard DOM query that requires no special permissions and takes 0.05 milliseconds to execute, any webpage can definitively confirm that the user is running Multilogin Mimic.
# 2. Stealthfox (Gecko Engine) Discrepancies
Multilogin's Firefox fork, Stealthfox, suffers from cross-engine contamination similar to AdsPower's FlowerBrowser. When their profile generator configures Stealthfox to impersonate a modern browser, it introduces impossible engine collisions.
Chromium PDF Plugins in a Gecko Engine
In stock Firefox, navigator.plugins only contains native PDF readers like PDF Viewer and Chrome PDF Viewer (the standard alias).
Stealthfox injects Edge-specific and WebKit-specific plugin names into Gecko's plugin list:
- ◆
Microsoft Edge PDF Viewer - ◆
WebKit built-in PDF
Neither plugin exists in Mozilla Firefox.
The Impossible "Windows NT 11.0" Kernel
In Windows 11, Microsoft kept the internal NT kernel version as NT 10.0 for application compatibility (build 22000+). Genuine Windows 11 systems always report Windows NT 10.0 in navigator.userAgent and navigator.oscpu.
Stealthfox's profile generator attempts to create a "Windows 11" fingerprint by literally setting:
navigator.oscpu = "Windows NT 11.0; Win64; x64"
Windows NT 11.0 does not exist in the real world. Any security scanner reading navigator.oscpu instantly catches this impossible version string.
# 3. High-Entropy Client Hints Desync in Mimic
In modern Chromium builds, User-Agent Client Hints (navigator.userAgentData.getHighEntropyValues) query the underlying operating system and engine build. Mimic's command-line injection flags introduce noticeable desynchronizations:
A. The Future Darwin Kernel (Darwin 26+)
When creating a macOS profile in Mimic, Multilogin launches Chromium with a custom --platform_version flag.
In several profile templates, Mimic passes --platform_version=26.4.
As of late 2024 / 2025, macOS 15 Sequoia runs on Darwin 24. Darwin 26 does not exist yet. Claiming to run on a Darwin kernel version two years in the future is an instant flag for automated fraud systems.
B. Major-Only Zeroing in FullVersionList
When Mimic injects custom brand versions using Chromium's --ch-add-brand-google-chrome command-line switch, it frequently zeroes out the sub-build digits in fullVersionList:
- ◆
fullVersionListreports:"128.0.0.0" - ◆
uaFullVersionreports the real engine build:"128.0.6613.119"
In genuine Google Chrome, fullVersionList and uaFullVersion match identically down to the patch release.
# The Multilogin Detector Code
Combining these checks produces a high-precision detector that flags both Mimic and Stealthfox:
window.detect_multilogin = async function () {
try {
// 1. Check Stealthfox (Gecko Engine)
const hasMozAppearance = typeof CSS !== 'undefined' &&
typeof CSS.supports === 'function' &&
CSS.supports('-moz-appearance: none');
const errStack = (new Error()).stack || '';
const hasGeckoStack = !errStack.includes('at ') && errStack.includes('@');
const isGecko = hasMozAppearance || hasGeckoStack;
if (isGecko) {
// Check for Chromium/Edge PDF plugins in Gecko
if (typeof navigator !== 'undefined' && navigator.plugins) {
const hasEdgePdf = navigator.plugins.namedItem('Microsoft Edge PDF Viewer') !== null;
const hasWebkitPdf = navigator.plugins.namedItem('WebKit built-in PDF') !== null;
if (hasEdgePdf || hasWebkitPdf) {
return true;
}
}
// Check for impossible Windows NT 11.0 kernel version
if (typeof navigator !== 'undefined' && typeof navigator.oscpu === 'string') {
if (navigator.oscpu.includes('Windows NT 11.0')) {
return true;
}
}
return false;
}
// 2. Check Mimic (Chromium Engine)
// Probe 2A: The "Paste as Human" Blink command leak
if (typeof document !== 'undefined' && typeof document.queryCommandSupported === 'function') {
if (document.queryCommandSupported('pasteAsHuman')) {
return true;
}
}
// Probe 2B: High-Entropy Client Hints invariants
if (typeof navigator !== 'undefined' && navigator.userAgentData && typeof navigator.userAgentData.getHighEntropyValues === 'function') {
const hints = await Promise.race([
navigator.userAgentData.getHighEntropyValues(['fullVersionList', 'uaFullVersion', 'platform', 'platformVersion']),
new Promise(resolve => setTimeout(() => resolve(null), 1000))
]);
if (hints) {
// macOS: Impossible Darwin Kernel Version (Darwin >= 25)
if (hints.platform === 'macOS' && typeof hints.platformVersion === 'string') {
const darwinMajor = parseFloat(hints.platformVersion);
if (Number.isFinite(darwinMajor) && darwinMajor >= 25) {
return true;
}
}
// Cross-platform OS desync (Linux on Windows host)
if (hints.platform === 'Linux') {
const navPlat = typeof navigator.platform === 'string' ? navigator.platform : '';
if (navPlat === 'Win32' || navPlat === 'Win64') {
return true;
}
}
}
}
return false;
} catch {
return false;
}
};# Conclusion
Multilogin is considered an industry standard, yet it can be detected with a single call to document.queryCommandSupported('pasteAsHuman').
This highlights the fundamental flaw of commercial anti-detect tools: when you bake proprietary helper features into browser source code, you leave behind unique digital footprints that fraud detection companies actively index.
If your business relies on web scraping, account automation, or ad verification, commercial tools will constantly create vulnerabilities. The only robust solution is building private, custom Chromium instances where unnecessary features are stripped and core engine invariants match real hardware down to the lowest C++ abstraction layer.
